Method and system for performing fail-safe operation for anti-skid automotive brake control system having a plurality of controllers independently operable to others

ABSTRACT

An anti-skid brake control system for an automotive brake system includes a plurality of controllers respectively adapted to perform anti-skid brake control operations for corresponding vehicular brake systems. A fail-safe system for the anti-skid brake control system includes a detector provided in each of the controllers, which detects malfunction of one or more components of the corresponding controller and/or the corresponding brake system, a disabling means responsive to malfunction of the component or components in the anti-skid brake control system for blocking electric power to an actuator controlling a pressure control valve, and means associated with the actuator and responsive to operation of the disabling means to operate the actuator to an application mode position in which the pressure control valve allows manual control of the brakes. Each of the controllers are associated to the others for performing fail-safe operation when one of the detectors in one of the controllers detects failure of anti-skid brake control operations in the corresponding controller and/or brake system.

BACKGROUND OF THE INVENTION

The present invention relates generally to an anti-skid brake controlsystem for an automotive vehicle for preventing vehicle wheels fromskidding, thereby, optimizing the braking performance of the vehicle,which control system includes a plurality of controllers respectivelyadapted to control the brake systems of a corresponding vehicular wheelor wheels. More particularly, the invention relates to a method of andsystem for performing fail-safe operation for an anti-skid brake controlsystem of the type having independently operable plural controllers eachcontrolling a corresponding brake system, which ensures that thevehicular brake system is rendered manually operable when the anti-skidcontrol malfunctions.

Various kinds of anti-skid automotive brake control systems are nowavailable. Anti-skid brake control systems generally control brakingpressure at a wheel cylinder or wheel cylinders in order to hold wheelslip relative to vehicle speed as close as possible to an optimal rate.In order to accomplish this, various approaches have been taken in theprior art.

U.S. Pat. No. 4,315,213, issued on Feb. 9, 1982 to Manfred WOLFF,discloses a method for obtaining an acceleration or deceleration signalfrom a signal proportional to speed and apparatus therefor. The methodfor obtaining an accleration or deceleration signal from a signalproportional to the speed consists of storing the n most recentlyascertained changes in the speed signal in a memory, and uponascertainment of a new change to be stored in memory, erasing the changewhich has been stored the longest, and forming a deceleration oracceleration signal by addition of the stored n changes periodically atintervals of dT. In this method, the occurrence of deceleration oracceleration exceeding the threshold is recognized quickly.

U.S. Pat. No. 4,267,575, issued on May 12, 1981 to Peter BOUNDS,discloses a system, which serves to provide signals to amicrocomputer-based control system from which instantaneous values ofspeed can be computed. The system includes a wheel-driven alternatorwhich provides an alternating current output whose frequency varies withwheel speed. A signal processor converts this signal to a series ofsensor pulses whose width varies inversely with frequency. A samplepulse supplied by a microprocessor sets the period or length of timeduring which the sensor pulses are examined for each speed calculationcycle of the microprocessor. The sample period pulses are AND-gated witha high-frequency clock signal and also with the sensor pulses to providea series of marker pulses marking the up and down excursions of thesensor pulses. The marker pulses occurring in each sample period arecounted directly in a first counter, and in addition are supplied to alatch circuit and from thence to an AND gate which responds to the firstmarker pulse in the sample period to count occurrences of the firstcounter exceeding its capacity. A third counter is also connected toreceive the high-frequency clock pulses and counts only the clock pulsesoccurring after the last marker pulse in the sample period. At the endof the sample period, the counts from all three counters are transferredto the microprocessor which uses this information to compute a value forwheel velocity over the sample period. The system continuously providesthe input counts to enable the microprocessor to calculate wheelvelocity over each sample period.

In another approach, U.S. Pat. No. 4,384,330 to Toshiro MATSUDA, issuedon May 17, 1983 discloses a brake control system for controllingapplication and release of brake pressure in order to prevent thevehicle from skidding. The system includes a sensing circuit fordetermining wheel rotation speed, a deceleration detecting circuit fordetermining the deceleration rate of the wheel and generating a signalwhen the determined deceleration rate becomes equal to or greater than apredetermined value, a target wheel speed circuit for determining atarget wheel speed based on the wheel rotation speed and operative inresponse to detection of a peak in the coefficient of friction betweenthe vehicle wheel and the road surface, and a control circuit forcontrolling application and release of brake fluid pressure to wheelcylinders for controlling the wheel deceleration rate. The wheelrotation speed sensing circuit detects the angular velocity of the wheelto produce alternating current sensor signal having a frequencycorresponding to the wheel rotation speed. The wheel rotation speedsensor signal value is differentiated to derive the deceleration rate.

Another approach for deriving acceleration has been disclosed in U.S.Pat. No. 3,943,345 issued on Mar. 9, 1976 to Noriyoshi ANDO et al. Thesystem disclosed includes a first counter for counting the number ofpulse signals corresponding to the rotational speed of a rotating body,a second counter for counting the number of pulses after the firstcounter stops counting, and a control circuit for generating an outputsignal corresponding to the difference between the counts of the firstand second counters.

Yet another approach has been taken to derive the wheel rotation speedwhich will be hereafter referred to as "wheel speed" based on input timedata representative of the times at which wheel speed sensor signalpulses are produced. For instance, by latching a timer signal value inresponse to the leading edge of each sensor signal pulse, the intervalsbetween occurrences of the sensor signal pulses can be measured. Theintervals between occurrences of the sensor signal pulses are inverselyproportional to the rotation speed of the wheel. Therefore, wheel speedcan be derived by finding the reciprocal of the measured intervals. Inaddition, wheel acceleration and deceleration can be obtained bycomparing successive intervals and dividing the obtained differencebetween intervals by the period of time over which the sensor signalswere sampled.

To perform this procedure, it is essential to record the input timing inresponse to every sensor signal pulse. A difficulty is encountered dueto significant variations in the sensor signal intervals according tosignificant variations in the vehicle speed. In recent years, modernvehicles can be driven at speeds in the range of about 0 km/h to 300km/h. Sensor signal intervals vary in accordance with this wide speedrange. In particular, when the vehicle is moving at a relatively highspeed, the input intervals of the sensor signal pulses may be too shortfor the anti-skid control system to resolve. As accurate sampling ofinput timing is essential for the proposed approach, errors in therecorded input time data will cause errors or malfunction of theanti-skid brake control system. One possible source of error in samplingthe input timing is accidentally missing one or more sensor signalpulses. Such errors are particularly likely to occur when the vehicleand wheel speeds are relatively high and therefore the intervals betweenadjacent sensor signal pulses are quite short.

U.S. Pat. No. 4,408,290, issued on Oct. 4, 1983 to the common inventorof this invention is intended to perform the foregoing input time datasampling for use in calculation of acceleration and deceleration. In thedisclosure of the applicant's prior invention, an acceleration sensoracts on the variable-frequency pulses of a speed sensor signal torecognize any variation of the pulse period thereof and to produce anoutput indicative of the magnitude of the detected variation to within afixed degree of accuracy. The durations of groups of pulses are held towithin a fixed range by adjusting the number of pulses in each group.The duration of groups of pulses are measured with reference to afixed-frequency clock pulse signal and the measurement periods ofsuccessive groups of equal numbers of pulses are compared. If thedifference between pulse group periods is zero or less than apredetermined value, the number of pulses in each group is increased inorder to increase the total number of clock pulses during themeasurement interval. The number of pulses per group is increased untilthe difference between measured periods exceeds the predetermined valueor until the number of pulses per group reaches a predetermined maximum.Acceleration data calculation and memory control procedure are designedto take into account the variation of the number of pulse per group.

The applicant has already filed an application directed to an anti-skidbrake control system which can control a plurality of vehicular wheelsindependently of each other, which application is pending under U.S.patent application Ser. No. 601,295 filed on Apr. 17, 1984 and underWest German Application No. P 34 17 144.4. The above-identifiedco-pending application also discloses a fail-safe system in which aplurality of controllers, each adapted to control the brakes for acorresponding vehicular wheel or wheels, monitor one another formalfunction. In the disclosed system, a back-up operation would beperformed which actuates the brake system to an application mode inwhich braking pressure is built up in the wheel cylinder when one of thecontrol systems malfunctions.

Another fail-safe system has been developed by the applicant anddisclosed in the Published Japanese Patent Application (Tokkai) Showa58-63558, published on Apr. 15, 1983. In the disclosed system, eachcomponent of the anti-skid control system is monitored in order todetect faulty operation thereof. When failure of a component orcomponents is detected, information concerning the faulty component orcomponents is stored in the fail-safe system. The memory storing thefault-identification data may be accessed later during maintenance.

The present invention concerns an improvement in the fail-safe system.Particularly, the invention concerns an improvement in the fail-safesystem disclosed in the foregoing Published Japanese Patent ApplicationNo. 58-63558.

SUMMARY OF THE INVENTION

It is, therefor an object of the present invention to provide ananti-skid brake control system which ensures enabling of brakingoperation even during failure of the anti-skid system.

Another and more specific object of the invention is to provide ananti-skid brake control system for an automotive vehicle, which canensure switching from an automatic control mode to a manual control modewhen failure of the system is detected and which can perform thefail-safe operation to switch the operation mode from an automaticcontrol mode to a manual control mode in not only hardware but also insoftware.

In order to accomplish the above and other objects, an anti-skid brakecontrol system for an automotive brake system of the type to which thepresent invention is applicable includes a plurality of controllersrespectively adapted to perform anti-skid brake control operation forrespectively corresponding vehicular brake systems. A fail-safe systemfor the anti-skid brake control system, according to the presentinvention, includes a detector provided in each of the controllers,which detects malfunction of one or more components of the correspondingcontroller and/or the corresponding brake system, a disabling meansresponsive to malfunction of the component or components in theanti-skid brake control system for blocking electric power supply to anactuator controlling a pressure control valve, and means associated withthe actuator and responsive to operation of the disabling means tooperate the actuator to an application mode position in which thepressure control valve allows manual control of the brakes. Each of thecontrollers are associated to the others for performing fail-safeoperation when one of the detectors in one of the controllers detectsfailure of anti-skid brake control operation in the correspondingcontroller and/or the brake system.

BRIEF DESCRIPTION OF THE DRAWINGS

The present invention will be understood more fully from the detaileddescription given below and from the accompanying drawings of thepreferred embodiments of the present invention, which, however, shouldnot be taken to limit the invention to the specific embodiments, but arefor explanation and understanding only.

FIG. 1 is a schematic block diagram of the general design of thepreferred embodiment of an anti-skid brake control system according tothe present invention;

FIG. 2 is a perspective illustration of the hydraulic circuits of theanti-skid brake system according to the present invention;

FIG. 3 is a circuit diagram of the hydraulic circuits performing theanti-skid control according to the present invention;

FIG. 4 is an illustration of the operation of an electromagnetic flowcontrol valve employed in the hydraulic circuit, which valve has beenshown in an application mode for increasing the fluid pressure in awheel cylinder;

FIG. 5 is a view similar to FIG. 4 but of the valve in a hold mode inwhich the fluid pressure in the wheel cylinder is held at asubstantially constant value;

FIG. 6 is a view similar to FIG. 4 but of the valve in a release mode inwhich the fluid pressure in the wheel cylinder is reduced;

FIG. 7 is a perspective view of a wheel speed sensor adapted to detectthe speed of a front wheel;

FIG. 8 is a side elevation of a wheel speed sensor adapted to detect thespeed of a rear wheel;

FIG. 9 is an explanatory illustration of the wheel speed sensors ofFIGS. 7 and 8;

FIG. 10 shows the waveform of an alternating current sensor signalproduced by the wheel speed sensor;

FIG. 11 is a timing chart for the anti-skid control system;

FIG. 12 is a block diagram of the preferred embodiment of a controllerunit in the anti-skid brake control system according to the presentinvention;

FIG. 13 is a flowchart of a main program of a microcomputer constitutingthe controller unit of FIG. 12;

FIG. 14 is a flowchart of an interrupt program executed by thecontroller unit;

FIG. 15 is a flowchart of a main routine in the main program of FIG. 13;

FIG. 16 is an explanatory diagram of the input timing sampling modes andvariations thereof;

FIG. 17 is another explanatory diagram of the sampling timing of thesensor pulse input timing;

FIG. 18 is a diagram of the period of time during which sensor pulsesare sampled in accordance with the present invention, which period oftime is compared with that used in the typical prior art;

FIG. 19 is a flowchart of a sample control program executed by thecontroller unit;

FIG. 20 is a flowchart of a timer overflow program executed periodicallyas an interrupt program of the main program;

FIG. 21 is a graph of the variation of a counter value of a clockcounter in the preferred embodiment of controller unit;

FIG. 22 is a timing chart of the timer overflow which is shown inrelation to the value of the timer overflow interrupt flag;

FIG. 23 is a flowchart of an output calculation program for deriving EVand V signals for controlling operation mode of the electromagneticvalve according to the valve conditions of FIGS. 4, 5 and 6;

FIGS. 24 and 25 are diagrams of execution timing of the outputcalculation program in relation to the main program;

FIG. 26 is a table determining the operation mode of the actuator 16,which table is accessed in terms of the wheel acceleration anddeceleration and the slip rate;

FIGS. 27A and 27B together form a circuit diagram of an overallanti-skid brake control system with the preferred embodiment offail-safe system according to the present invention;

FIG. 28 is an explanatory, schematic block diagram showing essentialfeatures of the controller to perform fail-safe operation;

FIG. 29 is a flowchart of a program to be executed as a background job;

FIG. 30 is a schematic block diagram of another embodiment of anti-skidbrake control system with a fail-safe system according to the presentinvention;.

FIG. 31 is a block diagram showing detailed structure of the controllerin the second embodiment of anti-skid brake control system of FIG. 30;and

FIG. 32 is a flowchart showing operation of the second embodiment of theanti-skid brake control system.

DESCRIPTION OF THE PREFERRED EMBODIMENTS

Referring now to the drawings, particularly to FIG. 1, the preferredembodiment of an anti-skid control system according to the presentinvention includes a control module 200 including a front-leftcontroller unit (FL) 202, a front-right controller unit (FR) 204 and arear controller unit (R) 206. The controller unit 202 comprises amicroprocessor and is adapted to control brake pressure applied to afront left wheel cylinder 30a of a front left hydraulic brake system 302of an automotive hydraulic brake system 300. Similarly, the controllerunit 204 is adapted to control brake pressure applied to the wheelcylinder 34a of a front right wheel (not shown) in the front righthydraulic brake system 304 and the controller unit 206 is adapted tocontrol brake pressure applied to the rear wheel cylinders 38a of thehydraulic rear brake system 306. Respective brake systems 302, 304 and306 have electromagnetically operated actuators 16, 18 and 20, each ofwhich controls the pressure of working fluid in the corresponding wheelcylinders. By means of the controlled pressure, the wheel cylinders 30a,34a and 38a apply braking force to brake disc rotors 28, 32 and 36mounted on the corresponding wheel axles for rotation with thecorresponding vehicle wheels via brake shoe assemblies 30, 34 and 38.

Though the shown brake system comprises disc brakes, the anti-skidcontrol system according to the present invention can also be applied todrum-type brake systems.

The controller units 202, 204 and 206 are respectively associated withactuator drive circuits 214, 216 and 218 to control operations ofcorresponding actuators 16, 18 and 20. In addition, each of thecontroller units 202, 204 and 206 is connected to a corresponding wheelspeed sensor 10, 12 and 14 via shaping circuits 208, 210 and 212incorporated in the controller 200. Each of the wheel speed sensors 10,12 and 14 is adapted to produce an alternating-current sensor signalhaving a frequency related to or proportional to the rotation speed ofthe corresponding vehicle wheel. Each of the A-C sensor signals isconverted by the corresponding shaping circuit 208, 210 and 212 into arectangular pulse signal which will be hereafter referred to as "sensorpulse signal". As can be appreciated, since the frequency of the A-Csensor signals is proportional to the wheel speed, the frequency of thesensor pulse signal should correspond to the wheel rotation speed andthe pulse intervals thereof will be inversely proportional to the wheelrotation speed.

The controller units 202, 204 and 206 operate independently andcontinuously process the sensor pulse signal to derive control signalsfor controlling the fluid pressure in each of the wheel cylinders 30a,34a and 38a in such a way that the slip rate R at each of the vehiclewheels is optimized to shorten the distance required to stop thevehicle, which distance will be hereafter referred to as "brakingdistance".

In general, each controller unit 202, 204 and 206 monitors receipt ofthe corresponding sensor pulses so that it can derive the pulse intervalbetween the times of receipt of successive sensor pulses. Based on thederived pulse interval, the controller units 202, 204 and 206 calculateinstantaneous wheel speed V_(w) and instantaneous wheel acceleration ordeceleration a_(w). From these measured and derived values, a targetwheel speed V_(i) is derived, which is an assumed value derived from thewheel speed at which a slip is assumed to zero or approximately zero.The target wheel speed V_(i) varies at a constant decelerating ratederived from variation of the wheel speed. The target wheel speed thuscorresponds to a vehicle speed which itself is based on variation of thewheel speed. Based on the difference between the instantaneous wheelspeed V_(w) and the target wheel speed V_(i), a slip rate R is derived.The controller units 202, 204 and 206 determine the appropriateoperational mode for increasing, decreasing or holding the hydraulicbrake pressure applied to the wheel cylinders 30a, 34a and 38a. Thecontrol mode in which the brake pressure is increased will be hereafterreferred to as "application mode". The control mode in which the brakepressure is decreased will be hereafter referred to as "release mode".The mode in which the brake pressure is held essentially constant willbe hereafter referred to as "hold mode". The anti-skid control operationconsists of a loop of the application mode, hold mode, release mode andhold mode. This loop is repeated throughout the anti-skid brake controloperation cyclically. One cycle of the loop of the control variationwill be hereafter referred to as "skid cycle".

FIG. 2 shows portions of the hydraulic brake system of an automotivevehicle to which the preferred embodiment of the anti-skid controlsystem is applied. The wheel speed sensors 10 and 12 are respectivelyprovided adjacent the brake disc rotor 28 and 32 for rotation therewithso as to produce sensor signals having frequencies proportional to thewheel rotation speed and variable in accordance with variation of thewheel speed. On the other hand, the wheel speed sensor 14 is providedadjacent a propeller shaft near the differential gear box or drivepinion shaft 116 for rotation therewith (See FIG. 8). Since the rotationspeeds of the left and right rear wheels are free to vary independentlydepending upon driving conditions due to the effect of the differentialgear box 40, the rear wheel speed detected by the rear wheel speedsensor 14 is the average of the speeds of the left and right wheels.Throughout the specification, "rear wheel speed" will mean the averagerotation speed of the left and right rear wheels.

As shown in FIG. 2, the actuator unit 300 is connected to a master wheelcylinder 24 via primary and secondary outlet ports 41 and 43 thereof andvia pressure lines 44 and 42. The master wheel cylinder 24 is, in turn,associated with a brake pedal 22 via a power booster 26 which is adaptedto boost the braking force applied to the brake pedal 22 before applyingsame to the master cylinder. The actuator unit 300 is also connected towheel cylinders 30a, 34a and 38a via brake pressure lines 46, 48 and 50.

The circuit lay-out of the hydraulic brake system circuit will bedescribed in detail below with reference to FIG. 3 which is only anexample of the hydraulic brake system to which the preferred embodimentof the anti-skid control system according to the present invention canbe applied, and so it should be appreciated that it is not intended tolimit the hydraulic system to the embodiment shown. In FIG. 3, thesecondary outlet port 43 is connected to the inlet ports 16b and 18b ofelectromagnetic flow control valves 16a and 18a, the respective outletports 16c and 18c of which are connected to corresponding left and rightwheel cylinders 30a and 34a, via the secondary pressure lines 46 and 48.The primary outlet port 41 is connected to the inlet port 20b of theelectromagnetic valve 20a, the outlet port 20c of which is connected tothe rear wheel cylinders 38a, via a primary pressure line 50. Theelectromagnetic valves 16a, 18a and 20a also have drain ports 16d, 18dand 20d. The drain ports 16d and 18d are connected to the inlet port 72aof a fluid pump 90 via drain passages 80, 82 and 78. The fluid pump 90is associated with an electric motor 88 to be driven by the latter whichis, in turn, connected to a motor relay 92, the duty cycle of which iscontrolled by means of a control signal from the control module 200.While the motor relay 92 is energized to be turned ON, the motor 88 isin operation to drive the fluid pump 90. The drain port 20d of theelectromagetic flow control valve 20a is connected to the inlet port 58aof the fluid pump 90 via a drain passage 64.

The outlet ports 72b and 58b are respectively connected to the pressurelines 42 and 44 via a return passages 72c and 58c. The outlet ports 16c,18c and 20c of respective electromagnetic flow control valves 16a, 18aand 20a are connected to corresponding wheel cylinders 30a, 34a and 38avia braking lines 46, 48 and 50. Bypass passages 96 and 98 are providedto connect the braking pressure lines 46 and 48, and 50 respectively tothe pressure lines 42 and 44, bypassing the electromagnetic flow controlvalves.

Pump pressure check valves 52 and 66 are installed in the pressure lines42 and 44. Each of the pump pressure check valves 66 and 52 is adaptedto prevent the working fluid pressurized by the fluid pump 90 fromtransmitting pressure surges to the master cylinder 24. Since the fluidpump 90 is designed for quick release of the braking pressure in thebraking pressure lines 46, 48 and 50 and thus releasing the wheelcylinders 38a, 34a and 38a from the braking pressure, it is driven uponrelease of the brake pedal. This would result in pressure surges in theworking fluid from the fluid pump 90 to the master cylinder 24 if thepump pressure check valves 66 and 52 were not provided. The pumppressure check valves 66 and 52 serve as one-way check valves allowingfluid flow from the master cylinder 24 to the inlet ports 16b, 18b and20b of the electromagnetic valves 16a, 18a and 20a. Pressureaccumulators 70 and 56 are installed in the pressure lines 42 and 44,which pressure accumulators serve to accumulate fluid pressure generatedat the outlet ports 72band 58b of the fluid pump 90 while the inletports 16b, 18b and 20b are closed. Toward this end, the pressureaccumulators 70 and 56 are connected to the outlet ports 72b and 58b ofthe fluid pump 90 via the return passages 72c and 58c. Outlet valves 68and 54 are one-way check valves allowing one-way fluid communicationfrom the fluid pump to the pressure accumulators. These outlet valves 68and 54 are effective for preventing the pressure accumulated in thepressure accumulators 70 and 56 from surging to the fluid pump when thepump is deactivated. In addition, the outlet valves 68 and 54 are alsoeffective to prevent the pressurized fluid flowing through the pressurelines 42 and 44 from flowing into the fluid pump 90 through the returnpassages 72c and 58c.

Inlet check valves 74 and 60 are inserted in the drain passages 78 and64 for preventing surge flow of the pressurized flow in the fluid pump90 to the electromagnetic flow control valves 16a, 18a and 20a after thebraking pressure in the wheel cylinders is released. The fluid flowingthrough the drain passages 78 and 64 is temporarily retained in fluidreservoirs 76 and 62 connected to the former.

Bypass check valves 85, 86 and 84 are inserted in the bypass passages 98and 96 for preventing the fluid in the pressure lines 42 and 44 fromflowing to the braking pressure lines 46, 48 and 50 without firstpassing through the electromagnetic flow control valves 16a, 18a and20a. On the other hand, the bypass check valves 85, 86 and 84 areadapted to permit fluid flow from the braking pressure line 46, 48 and50 to the pressure lines 42 and 44 when the master cylinder 24 isreleased and thus the line pressure in the pressure lines 42 and 44becomes lower than the pressure in the braking pressure lines 46, 48 and50.

The electromagnetic flow control valves 16a, 18a and 20a arerespectively associated with the actuators 16, 18 and 20 to becontrolled by means of the control signals from the control module 200.The actuators 16, 18 and 20 are all connected to the control module 200via an actuator relay 94, which thus controls the energization anddeenergization of them all. Operation of the electromagnetic valve 16ain cooperation with the actuator 16 will be illustrated with referenceto FIGS. 4, 5 and 6, in particular illustrating the application mode,hold mode and release mode, respectively.

It should be appreciated that the operation of the electromagneticvalves 18a and 20a are substantially the same as that of the valve 16a.Therefore, disclosure of the valve operations of the electromagneticvalves 18a and 20a is omitted in order to avoid unnecessary repetitionand for simplification of the disclosure.

APPLICATION MODE

In this position, the actuator 16 remains deenergized. An anchor of theelectromagnetic valve 16a thus remains in its initial position allowingfluid flow between the inlet port 16b and the outlet port 16c so thatthe pressurized fluid supplied from the master cylinder 24 via thepressure line 242 may flow to the left front wheel cylinder 30a via thebraking pressure line 46. In this valve position, the drain port 16d isclosed to block fluid flow from the pressure line 42 to the drainpassage 78. As a result, the line pressure in the braking pressure line46 is increased in proportion to the magnitude of depression of thebrake pedal 22 and thereby the fluid pressure in the left front wheelcylinder 30a is increased correspondingly.

In this case, when the braking force applied to the brake pedal isreleased, the line pressure in the pressure line 42 drops due to returnof the master cylinder 24 to its initial position. As a result, the linepressure in the braking pressure line 46 becomes higher than that in thepressure line 42 and so opens the bypass valve 85 to permit fluid flowthrough the bypass passage 98 to return the working fluid to the fluidreservoir 24a of the master cylinder 24.

In the preferring construction, the pump pressure check valve 66,normally serving as a one-way check valve for preventing fluid flow fromthe electromagnetic valve 16a to the master cylinder 24, becomeswide-open in response to drop of the line pressure in the pressure linebelow a given pressure. This allows the fluid in the braking pressureline 46 to flow backwards through the electromagnetic valve 16a and thepump pressure check valve 66 to the master cylinder 24 via the pressureline 42. This function of the pump pressure check valve 66 facilitatesfull release of the braking pressure in the wheel cylinder 30a.

For instance, the bypass valve 85 is rotated at a given set pressure,e.g. 2 kg/cm² and closes when the pressure difference between thepressure line 42 and the braking pressure line 46 drops below the setpressure. As a result, fluid pressure approximating the bypass valve setpressure tends to remain in the braking pressure line 46, preventing thewheel cylinder 30a from returning to the fully released position. Inorder to avoid this, in the shown embodiment, the one-way check valvefunction of the pump pressure check valve 66 is disabled when the linepressure in the pressure line 42 drops below a predetermined pressure,e.g. 10 kg/cm². When the line pressure in the pressure line 42 dropsbelow the predetermined pressure, a bias force normally applied to thepump pressure check valve 66 is released, freeing the valve to allowfluid flow from the braking pressure line 46 to the master cylinder 24via the pressure line 42.

HOLD MODE

In this control mode, a limited first valve, e.g. 2A of electric currentserving as the control signal is applied to the actuator 16 to positionthe anchor closer to the actuator 16 than in the previous case. As aresult, the inlet port 16b and the drain port 16d are closed to blockfluid communication between the pressure line 42 and the brakingpressure line 46 and between the braking pressure line and the drainpassage 78. Therefore, the fluid pressure in the braking pressure line46 is held at the level extant at the moment the actuator is operated bythe control signal.

In this case, the fluid pressure applied through the master cylinderflows through the pressure check valve 66 to the pressure accumulator70.

RELEASE MODE

In this control mode, a maximum value, e.g., 5A of electric currentserving as the control signal is applied to the actuator 16 to shift theanchor all the way toward the actuator 16. As a result, the drain port16d is opened to establish fluid communication between the drain port16d and the outlet port 16c. At this time, the fluid pump 90 serves tofacilitate fluid flow from the braking pressure line 46 to the drainpassage 78. The fluid flowing through the drain passage is partlyaccumulated in the fluid reservoir 76 and the remainder flows to thepressure accumulator 70 via the check valves 60 and 54 and the fluidpump 90.

It will be appreciated that, even in this release mode, the fluidpressure in the pressure line 42 remains at a level higher or equal tothat in the braking pressure line 46, so that fluid flow from thebraking pressure line 46 to the pressure line 42 via the bypass passage98 and via the bypass check valve 85 will never occur.

In order to resume the braking pressure in the wheel cylinder (FL) 30aafter once the braking pressure is reduced by positioning theelectromagnetic valve 16a in the release position, the actuator 16 isagain denergized. The electromagnetic valve 16a is thus returns to itsinitial position to allow the fluid flow between the inlet port 16b andthe outlet port 16c so that the pressurized fluid may flow to the leftfront wheel cylinder 30a via the braking pressure line 46. As set forththe drain port 16d is closed to block fluid flow from the pressure line42 to the drain passage 78.

As a result, the pressure accumulator 70 is connected to the left frontwheel cylinder 30a via the electromagnetic valve 16a and the brakingpressure line 46. The pressurized fluid in the pressure accumulator 70is thus supplied to the wheel cylinder 30a so as to resume the fluidpressure in the wheel cylinder 30a.

At this time, as the pressure accumulator 70 is connected to the fluidreservoir 76 via the check valves 60 and 54 which allow fluid flow fromthe fluid reservoir to the pressure accumulator, the extra amount ofpressurized fluid may be supplied from the fluid reservoir.

The design of the wheel speed sensors 10, 12 and 14 employed in thepreferred embodiment of the anti-skid control system will be describedin detail with reference to FIGS. 7 to 9.

FIG. 7 shows the structure of the wheel speed sensor 10 for detectingthe rate of rotation of the left front wheel. The wheel speed sensor 10generally comprises a sensor rotor 104 adapted to rotate with thevehicle wheel, and a sensor assembly 102 fixedly secured to the shimportion 106 of the knuckle spindle 108. The sensor rotor 104 is fixedlysecured to a wheel hum 109 for rotation with the vehicle wheel.

As shown in FIG. 9, the sensor rotor 104 is formed with a plurality ofsensor teeth 120 at regular angular intervals. The width of the teeth120 and the grooves 122 therebetween are equal in the shown embodimentand define a unit angle of wheel rotation. The sensor assembly 102comprises a magnetic core 124 aligned with its north pole (N) near thesensor rotor 104 and its south pole (S) distal from the sensor rotor. Ametal element 125 with a smaller diameter section 125a is attached tothe end of the magnetic core 124 nearer the sensor rotor. The free endof the metal element 125 faces the sensor teeth 120. An electromagneticcoil 126 encircles the smaller diameter section 125a of the metalelement. The electromagnetic coil 126 is adapted to detect variations inthe magnetic field generated by the magnetic core 124 to produce analternating-current sensor signal as shown in FIG. 10. That is, themetal element and the magnetic core 124 form a kind of proximity switchwhich adjusts the magnitude of the magnetic field depending upon thedistance between the free end of the metal element 125 and the sensorrotor surface. Thus, the intensity of the magnetic field fluctuates inrelation to the passage of the sensor teeth 120 and accordingly inrelation to the angular velocity of the wheel.

It should be appreciated that the wheel speed sensor 12 for the rightfront wheel has the substantially the same structure as the set forthabove. Therefore, explanation of the structure of the right wheel speedsensor 12 will be omitted in order to avoid unnecessary repetition inthe disclosure and in order to simplify the description.

FIG. 8 shows the structure of the rear wheel speed sensor 14. As withthe aforementioned left front wheel speed sensor 10, the rear wheelspeed sensor 14 comprises a sensor rotor 112 and a sensor assembly 102.The sensor rotor 112 is associated with a companion flange 114 which is,in turn, rigidly secured to a drive shaft 116 for rotation therewith.Thus, the sensor rotor 112 rotates with the drive shaft 116. The sensorassembly 102 is fixed to a final drive housing or a differential gearbox (not shown).

Each of the sensor assemblies applied to the left and right front wheelspeed sensors and the rear wheel sensor is adapted to output analternating-current sensor signal having a frequency proportional to orcorresponding to the rotational speed of the corresponding vehiclewheel. The electromagnetic coil 126 of each of the sensor assemblies 102is connected to the control module 200 to supply the sensor signalsthereto.

As set forth above, the control module 200 comprises the controller unit(FL) 202, the controller unit (FR) 204 and the controller unit (R) 206,each of which comprises a microcomputer. Therefore, the wheel speedsensors 10, 12 and 14 are connected to corresponding controller units202, 204 and 206 and send their sensor signals thereto. Since thestructure and operation of each of the controller units is substantiallythe same as that of the others, the structure and operation of only thecontroller unit 202 for performing the anti-skid brake control for thefront left wheel cylinder will be explained in detail.

FIG. 11 is a timing chart of the anti-skid control performed by thecontroller unit 202. As set forth above, the alternating-current sensorsignal output from the wheel speed sensor 10 is converted into arectangular pulse train, i.e. as the sensor pulse signal mentionedabove. The controller unit 202 monitors occurrences of sensor pulses andmeasures the intervals between individual pulses or between the firstpulses of groups of relatively-high-frequency pulses. Pulses are sogrouped that the measured intervals will exceed a predetermined value,which value will be hereafter referred to as "pulse interval threshold".

The wheel rotation speed V_(w) is calculated in response to each sensorpulse. As is well known, the wheel speed is generally inverselyproportional to the intervals between the sensor pulses, andaccordingly, the wheel speed V_(w) is derived from the interval betweenthe last sensor pulse input time and the current sensor pulse inputtime. A target wheel speed is designated V_(i) and the resultant wheelspeed is designated V_(w). In addition, the slip rate is derived fromthe rate of change of the wheel speed and an projected speed V_(v) whichis estimated from the wheel speed at the moment the brakes are appliedbased on the assumption of a continuous, linear deceleration withoutslippage. In general, the target wheel speed V_(i) is derived from thewheel speed of the last skid cycle during which the wheel decelerationrate was equal to or less than a given value which will be hereafterreferred to as "deceleration threshold a_(ref) ", and the wheel speed ofthe current skid cycle, and by estimating the rate of change of thewheel speed between wheel speeds at which the rate of deceleration isequal to or less than the deceleration threshold. In practice, the firsttarget wheel speed V_(i) is derived based on the projected speed V_(v)which corresponds to a wheel speed at the initial stage of brakingoperation and at which wheel deceleration exceeds a predetermined value,e.g. -1.2 G, and a predetermined deceleration rate, for example 0.4 G.The subsequent target wheel speed V_(i) is derived based on theprojected speeds V_(v) in last two skid cycles. For instance, thedeceleration rate of the target wheel speed V_(i) is derived from adifference of the projected speeds V_(v) in the last two skid cycle anda period of time in which wheel speed varies from the first projectedspeed to the next projected speed. Based on the last projected speed andthe deceleration rate, the target wheel speed in the current skid cycleis derived.

The acceleration and deceleration of the wheel is derived based on theinput time of three successive sensors pulses. Since the interval of theadjacent sensor signal pulses correspnds to the wheel speed, and thewheel speed is a function of the reciprocal of the interval, bycomparing adjacent pulse-to-pulse intervals, a value corresponding tothe variation or difference of the wheel speed may be obtained. Thereslultant interval may be divided by the period of time of the intervalin order to obtain the wheel acceleration and deceleration at the unittime. Therefore, the acceleration or deceleration of the wheel isderived from the following equation: ##EQU1## where A, B and C are theinput times of the sensor pulses in the order given.

On the other hand, the slip rate R is a rate of difference of wheelspeed relative to the vehicle speed which is assumed as substantiallycorresponding to the target wheel speed. Therefore, in the shownembodiment, the target wheel speed V_(i) is taken as variable orparameter indicative of the assumed or projected vehicle speed. The sliprate R can be obtained by dividing a difference between the target wheelspeed V_(i) and the instantaneous wheel speed V_(w) by the target wheelspeed. Therefore, in addition, the slip rate R is derived by solving thefollowing equation: ##EQU2##

Finally, the controller unit 202 determines the control mode, i.e.,release mode, hold mode and application mode from the slip rate R andthe wheel acceleration or deceleration a_(w).

General operation of the controller unit 202 will be briefly explainedherebelow with reference to FIG. 11. Assuming the brake is applied at t₀and the wheel deceleration a_(w) exceeds the predetermined value, e.g.1.2 G at a time t₁, the controller unit 202 starts to operate at a timet₁. The first sensor pulse input time (t₁) is held in the controllerunit 202. Upon receipt of the subsequent sensor pulse at a time t₂, thewheel speed V_(w) is calculated by deriving the current sensor pulseperiod (dt=t₂ -t₁). In response to the subsequently received sensorpulses at times t₃, t₄ . . . , the wheel speed values V_(w2), V_(w3) . .. are calculated.

On the other hand, at the time t₁, the instantaneous wheel speed istaken as the projected speed V_(v). Based on the projected speed V_(v)and the predetermined fixed value, e.g. 0.4 G, the target wheel speedV_(i) decelerating at the predetermined deceleration rate 0.4 G isderived.

In anti-skid brake control, the braking force applied to the wheelcylinder is to be so adjusted that the peripheral speed of the wheel,i.e. the wheel speed, during braking is held to a given ratio, e.g. 85%to 80% of the vehicle speed. Therefore, the slip rate R has to bemaintained below a given ratio, i.e., 15% to 10%. In the preferredembodiment, the control system controls the braking force so as tomaintain the slip rate at about 15%. Therefore, a reference valueR_(ref) to be compared with the slip rate R is determined at a value of85% of the projected speed V_(v). As will be appreciated, the referencevalue is thus indicative of a slip rate threshold, which will behereafter referred to "slip rate threshold R_(ref) " throughout thespecification and claims, and varies according to variation of thetarget wheel speed.

In practical brake control operation performed by the preferredembodiment of the anti-skid control system according to the presentinvention, the electric current applied to the actuator attains alimited value, e.g., 2A to place the electromagnetic valve 30a in thehold mode as shown in FIG. 5 when the wheel speed remains inbetween thetarget wheel speed V_(i) and the slip rate threshold R_(ref). When theslip rate derived from the target wheel speed V_(i) and the wheel speedV_(w) becomes equal to or larger than the slip rate threshold R_(ref),then the supply current to the actuator 16 is increased to a maximumvalue, e.g. 5A to place the electromagnetic valve in the release mode asshown in FIG. 6. By maintaining the release mode, the wheel speed V_(w)is recovered to the target wheel speed. When the wheel speed is thusrecovered or resumed so that the slip rate R at that wheel speed becomesequal to or less than the slip rate threshold R_(ref), then the supplycurrent to the actuator 16 is dropped to the limited value, e.g. 2A toreturn the electromagnetic valve 30a to the hold mode. By holding thereduced fluid pressure in the wheel cylinder, the wheel speed V_(w) isfurther resumed to the target wheel speed V_(i). When the wheel speedV_(w) is resumed equal to or higher than the target wheel speed V_(i),the supply current is further dropped to zero for placing theelectromagnetic valve in the application mode as shown in FIG. 4. Theelectromagnetic valve 30a is maintained in the application mode untilthe wheel speed is decelerated at a wheel speed at which the wheeldeceleration becomes equal to or slightly more than the decelerationthreshold R_(ref) -1.2 G. At the same time, the projected speed V_(v) isagain derived with respect to the wheel speed at which the wheeldeceleration a_(w) becomes equal to or slightly larger than thedeceleration threshold a_(ref). From a difference of speed of the lastprojected speed and the instant projected speed and the period of timefrom a time obtaining the last projected speed to a time obtaining theinstant projected speed, a deceleration rate of the target wheel speedV_(i) is derived. Therefore, assuming the last projected speed isV_(v1), the instant projected speed is V_(v2), and the period of time isT_(v), the target wheel speed V_(i) can be obtained from the followingequation:

    V.sub.i =V.sub.v2 -(V.sub.v1 -V.sub.v2)/T.sub.v ×t.sub.e

where t_(e) is an elapsed time from the time at which the instantprojected speed V_(v2) is obtained.

Based on the input timing to t₁, t₂, t₃, t₄ . . . , deceleration ratea_(w) is derived from the foregoing equation (1). In addition, theprojected speed V_(v) is estimated as a function of the wheel speedV_(w) and rate of change thereof. Based on the instantaneous wheelspeeds V_(w1) at which the wheel deceleration is equal to or less thanthe deceleration threshold a_(ref) and the predetermined fixed value,e.g. 0.4 G for the first skid cycle of control operation, the targetwheel speed V_(i) is calculated. According to equation (2), the sliprate R is calculated, using successive wheel speed values V_(w1),V_(w2), V_(w3) . . . as parameters. The derived slip rate R is comparedwith the slip rate threshold R_(ref). As the wheel speed V_(w) dropsbelow the projected speed V_(v) at the time t₁, the controller unit 202switches the control mode from the application mode to the hold mode.Assuming also that the slip rate R exceeds the slip rate threshold atthe time t₄, then the controller unit 202 switches the control mode tothe release mode to release the fluid pressure at the wheel cylinder.

Upon release of the brake pressure in the wheel cylinder, the wheelspeed V_(w) recovers, i.e. the slip rate R drops until it is smallerthan the slip rate threshold at time t₇. The controller unit 202 detectswhen the slip rate R is smaller than the slip rate threshold R_(ref) andswitches the control mode from release mode to the hold mode.

By maintaining the brake system in the hold mode in which reduced brakepressure is applied to the wheel cylinder, the wheel speed increasesuntil it reaches the projected speed as indicated by the intersection ofthe dashed line (V_(v)) and the solid trace in the graph of V_(w) inFIG. 11. When the wheel speed V_(w) becomes equal to the target wheelspeed V_(i) (at a time t₈), the controller unit 202 switches the controlmode from the hold mode to the application mode.

As can be appreciated from the foregoing description, the control modewill tend to cycle through the control modes in the order applicationmode, hold mode, release mode and hold mode, as exemplified in theperiod of time from t₁ to t₈. This cycle of variation of the controlmodes will be referred to hereafter as "skid cycle". Practicallyspeaking, there will of course be some hunting and other minordeviations from the standard skid cycle.

The projected speed V_(v), which is meant to represent ideal vehiclespeed behavior, at time t₁ can be obtained directly from the wheel speedV_(w) at that time since zero slip is assumed. At the same time, thedeceleration rate of the vehicle will be assumed to be a predeterminedfixed value or the appropriate one of a family thereof, in order toenable calculation of the target wheel speed for the first skid cycleoperation. Specifically, in the shown example, the projected speed V_(v)at the time t₁ will be derived from the wheel speed V_(w1) at that time.Using the predetermined deceleration rate, the projected speed will becalculated at each time the wheel deceleration a_(w) in the applicationmode reaches the deceleration threshold a_(ref).

At time t₉, the wheel deceleration a_(w) becomes equal to or slightlylarger than the deceleration threshold a_(ref), then the secondprojected speed V_(v2) is obtained at a value equal to the instantaneouswheel speed V_(w) at the time t₉. According to the above-mentionedequation, the deceleration rate da can be obtained

    da=(V.sub.v1 -V.sub.v2)/(t.sub.9 -t.sub.1)

Based on the derived deceleration rate da, the target wheel speed V_(i)' for the second skid cycle of control operation is derived by:

    V.sub.i '=V.sub.v2 -da×t.sub.e

Based on the derived target wheel speed, the slip rate threshold R_(ref)for the second cycle of control operation is also derived. As will beappreciated from FIG. 11, the control mode will be varied during thesecond cycle of skid control operation, to hold mode at time t₉ at whichthe wheel deceleration reaches the deceleration threshold a_(ref) as setforth above, to release mode at time t₁₀ at which the slip rate Rreaches the slip rate threshold R_(ref), to hold mode at time t₁₁ atwhich the slip rate R is recovered to the slip rate threshold R_(ref),and to application mode at time t₁₂ at which the wheel speed V_(w)recovered or resumed to the target wheel speed V_(i) '. Further, itshould be appreciated that in the subsequent cycles of the skid controloperations, the control of the operational mode of the electromagneticvalve as set forth with respect to the second cycle of controloperation, will be repeated.

Relating the above control operations to the structure of FIGS. 3through 6, when application mode is used, no electrical current isapplied to the actuator of the electromagnetic valve 16a so that theinlet port 16b communicates with the outlet port 16c, allowing fluidflow between the pressure passage 42 and the brake pressure line 46. Alimited amount of electrical current (e.g. 2A) is applied at times t₁,t₇, t₉ and t₁₁, so as to actuate the electromagnetic valve 16a to itslimited stroke position by means of the actuator 16, and the maximumcurrent is applied to the actuator as long as the wheel speed V_(w) isnot less than the projected speed and the slip rate is greater than theslip rate threshold R_(ref). Therefore, in the shown example, thecontrol mode is switched from the application mode to the hold mold attime t₁ and then to the release mode at time t₄. At time t₇, the sliprate increases back up to the slip rate threshold R_(ref), so that thecontrol mode returns to the hold mode, the actuator driving theelectromagnetic valve 16a to its central holding position with thelimited amount of electrical current as the control signal. When thewheel speed V_(i) at time t₈, the actuator 16 supply current is cut offso that the electromagnetic valve 16a returns to its rest position inorder to establish fluid communication between the pressure line 42 andthe braking pressure line 46 via inlet and outlet ports 16b and 16c.

Referring to FIG. 12, the controller unit 202 includes an inputinterface 230, CPU 232, an output interface 234, RAM 236 and ROM 238.The input interface 230 includes an interrupt command generator 229which produces an interrupt command in response to every sensor pulse.In ROM, a plurality of programs including a main program (FIG. 13), aninterrupt program (FIG. 15), an sample control program (FIG. 19), atimer overflow program (FIG. 20) and an output calculation program (FIG.23) are stored in respectively corresponding address blocks 244, 246,250, 252 and 254.

The input interface also has a temporary register for temporarilyholding input timing for the sensor pulses. RAM 236 similarly has amemory block holding input timing for the sensor pulses. The contents ofthe memory block 240 of RAM may be shifted whenever calculations of thepulse interval, wheel speed, wheel acceleration or deceleration, targetwheel speed, slip rate and so forth are completed. One method ofshifting the contents is known from the corresponding disclosure of theU.S. Pat. No. 4,408,290. The disclosure of the U.S. Pat. No. 4,408,290is hereby incorporated by reference. RAM also has a memory block 242 forholding pulse intervals of the input sensor pulses. The memory block 242is also adapted to shift the contents thereof according to the mannersimilar to set forth in the U.S. Pat. No. 4,408,290.

An interrupt flag 256 is provided in the controller unit 202 forsignalling interrupt requests to the CPU. The interrupt flag 256 is setin response to the interrupt command from the interrupt commandgenerator 229. A timer overflow interrupt flag 258 is adapted to set anoverflow flag when the measured interval between any pair of monitoredsensor pulses exceeds the capacity of a clock counter.

In order to time the arrival of the sensor pulses, a clock is connectedto the controller unit 202 to feed time signals indicative of elapsedreal time. The timer signal value is latched whenever a sensor pulse isreceived and stored in either or both of the temporary register 231 inthe input interface 230 and the memory block 240 of RAM 236.

The operation of the controller unit 202 and the function of eachelements mentioned above will be described with reference to FIGS. 13 to30.

FIG. 13 illustrates the main program for the anti-skid control system.Practically speaking, this program will generally be executed as abackground job, i.e. it will have a lower priority than most otherprograms under the control of the same processor. Its first step 1002 isto wait until at least one sample period, covering a single sensor pulseor a group thereof, as described in more detail below, is completed asindicated when a sample flag FL has a non-zero value. In subsequent step1004, the sample flag FL is checked for a value greater than one, whichwould indicate the sample period is too short. If this is the case,control passes to a sample control program labelled "1006" in FIG. 13but shown in more detail in FIG. 19. If FL=1, then the control processis according to plan, and control passes to a main routine explainedlater with reference to FIG. 15. Finally, after completion of the mainroutine, a time overflow flag OFL is reset to signify successfulcompletion of another sample processing cycle, and the main programends.

FIG. 14 shows the interrupt program stored in the memory block 246 ofROM 238 and executed in response to the interrupt command generated bythe interrupt command generator 229 whenever a sensor pulse is received.It should be noted that a counter value NC of an auxiliary counter 233is initially set to 1, a register N representing the frequency dividerratio is set at 1, and a counter value M of an auxiliary counter 235 isset at -1. After starting execution of the interrupt program, thecounter value NC of the auxiliary counter 233 is decremented by 1 at ablock 3002. The auxiliary counter value NC is then checked at a block3004 for a value greater than zero. For the first sensor pulse, sincethe counter value NC is decremented by 1 (1-1=0) at the block 3002 andthus is zero, the answer of the block 3004 is NO. In this case, theclock counter value t is latched in a temporary register 231 in theinput interface 230 at a block 3006. The counter value NC of theauxiliary counter 233 is thereafter assigned the value N in a register235, which register value N is representative of frequency dividingratio determined during execution of the main routine explained later,at a block 3008. The value M of an auxiliary counter 235 is thenincremented by 1. The counter value M of the auxiliary counter 235labels each of a sequence of sample periods covering an increasingnumber of sensor pulses. After this, the sample flag FL is incrementedby 1 at a block 3012. After the block 3012, interrupt program ends,returning control to the main program or back to block 3002, whichevercomes first.

On the other hand, when the counter value NC is non-zero when checked atthe block 3004, this indicates that not all of the pulses for thissample period have been received, and so the interrupt program endsimmediately.

This interrupt routine thus serves to monitor the input timing t of eachpulse sampling period, i.e. the time t required to receive NC pulses,and signals completion of each sample period (M=0 through M=10, forexample) for the information of the main program.

Before describing the operation in the main routine, the general methodof grouping the sensor pulses into sample periods will be explained tofacilitate understanding of the description of the operation in the mainroutine.

In order to enable the controller unit 202 to accurately calculate thewheel acceleration and deceleration a_(w), it is necessary that thedifference between the pulse intervals of the single or grouped sensorpulses exceeding a given period of time, e.g. 4 ms. In order to obtainthe pulse interval difference exceeding the given period of time, 4 ms,which given period of time will be hereafter referred to as "pulseinterval threshold S", some sensor pulses are ignored so that therecorded input timing t of the sensor pulse groups can satisfy thefollowing formula:

    dT=(C-B)-(B-A)≧S (4 ms.)                            (3)

where A, B and C are the input times of three successive sensor pulsegroups.

The controller unit 202 has different sample modes, i.e. MODE 1, MODE 2,MODE 3 and MODE 4 determining the number of sensor pulses in each sampleperiod group. As shown in FIG. 16, in MODE 1 every sensor pulse inputtime is recorded and therefore the register value N is 1. In MODE 2,every other sensor pulse is ignored and the register value N is 2. InMODE 3, every fourth sensor pulse is monitored, i.e. its input time isrecorded, and the register value N is 4. In MODE 4, every eighth sensorpulse is sampled and the register value N is then 8.

The controller unit 202 thus samples the input timing of threesuccessive sensor pulses to calculate the pulse interval difference dTwhile operating in MODE 1. If the derived pulse interval difference isequal to or greater than the pulse interval threshold S, then sensorpulses will continue to be sampled in MODE 1. Otherwise, the inputtiming of every other sensor pulse is sampled in MODE 2 and from thesampled input timing of the next three sensor pulses sampled, the pulseinterval difference dT is calculated to again be compared with the pulseinterval threshold S. If the derived pulse interval difference is equalto or greater than the pulse interval threshold S, we remain in MODE 2.Otherwise, every four sensor pulses are sampled in MODE 3. The inputtimings of the next three sampled sensor pulses are processed to derivethe pulse interval difference dT. The derived pulse interval differencedT is again compared with the pulse interval threshold S. If the derivedpulse interval difference is equal to or greater than the pulse intervalthreshold S, the MODE remains at 3 and the value N is set to 4. On theother hand, if the derived pulse interval difference dT is less than thepulse interval threshold S, the mode is shifted to MODE 4 to sample theinput timing of every eighth sensor pulse. In this MODE 4, the value Nis set at 8.

For instance, in FIG. 16, the sensor pulses A₁, B₁ and C₁ are sampledunder MODE 1. In MODE 2, the sensor pulses a₁ and c₁ are ignored and thesensor pulses A₁ (=A₂), B₂ (=b₁) and C₂ (=b₂ =a₃) are sampled. In MODE3, the three sensor pulses c₂ (=b₃ =a₄), c₃ (=b₄) and c₄ following B₃(=c₂) are ignored and the sensor pulses A₃ (=A₁ =A₂), B₃ (=b₂ =a₃) andC₃ (=b₅ =a₆) are sampled. In MODE 4, the seven sensor pulses c₅ (=b₆=a₇), c₆ (=b₇ =a₈), c₇ (=b₈ =a₉), c₈ (=b₉ =a₁₀), c₉ (=b₁₀ =a.sub. 11),c₁₀ (=b₁₁) and c₁₁ following B₄ (=c₃) are ignored and the sensor pulsesA₄ (=A₁ =A₂ =A₃), B₄ (=C₃ =b₅ =a₆) and C₄ are sampled.

Referring to FIG. 15, the main routine serves to periodically derive anupdated wheel acceleration rate value a_(w). In general, this is done bysampling larger and larger groups of pulses until the difference betweenthe durations of the groups is large enough to yield an accurate value.In the main routine, the sample flag FL is reset to zero at a block2001. Then the counter value M of the auxiliary counter 233, indicatingthe current sample period of the current a_(w) calculation cycle, isread out at a block 2002 to dictate the subsequent program steps.

Specifically, after the first sample period (M=.0.), the input timing ttemporarily stored in the temporary register 231 corresponding to thesensor pulse number (M=0) is read out and transferred to a memory block240 of RAM at a block 2004, which memory block 240 will be hereafterreferred to as "input timing memory". Then control passes to the block1008 of the main program. When M=2, the corresponding input timing t isread out from the temporary register 231 and transferred to the inputtiming memory 240 at a block 2006. Then, at a block 2008, a pulseinterval Ts between the sensor pulses of M=1 is derived from the twoinput timing values in the input timing memory 240. That is, the pulseinterval of the sensor pulse (M=1) is derived by:

    Ts=t.sub.1 -t.sub.0

where

t₁ is input time of the sensor pulse M1; and

t₀ is input time of the sensor pulse M0.

The derived pulse interval T_(s) of the sensor pulse M1 is then comparedwith a reference value, e.g. 4 ms., at a block 2010. If the pulseinterval T_(s) is shorter than the reference value, 4 ms., controlpasses to a block 2012 wherein the value N and the pulse interval T_(s)are multiplied by 2. The doubled timing value (2T_(s)) is again comparedwith the reference value by returning to the block 2010. The blocks 2010and 2012 constitute a loop which is repeated until the pulse interval(2nT_(s)) exceeds the reference value. When the pulse interval (2nT_(s))exceeds the reference value at the block 2010, a corresponding value ofN (2N) is automatically selected. This N value represents the number ofpulses to be treated as a single pulse with regard to timing.

After setting the value of N and thus deriving the sensor pulse groupsize then the auxiliary counter value NC is set to 1, at a block 2016.The register value N is then checked for a value of 1, at a block 2018.If N=1, then the auxiliary counter value M is set to 3 at a block 2020and otherwise control returns to the main program. When the registervalue N equals 1, the next sensor pulse, which would normally beignored, will instead be treated as the sensor pulse having the sampleperiod number M=3.

In the processing path for the sample period number M=3, thecorresponding input timing is read from the corresponding address of thetemporary register 231 and transferred to the input timing memory 240,at a block 2024. The pulse interval T₂ between the sensor pulses at M=1and M=3 is then calculated at a block 2026. The derived pulse intervalT₂ is written in a storage section of a memory block 242 of RAM 236 fora current pulse interval data, which storage section will be hereafterreferred at as "first pulse interval storage" and which memory block 242will be hereafter referred to as "pulse interval memory". After theblock 2026, control returns to the main program to await the next sensorpulse, i.e. the sensor pulse for sample period number M=4.

When the sensor pulse for M=4 is received, the value t of the temporaryregister 231 is read out and transferred to the input timing memory 240at block 2028. Based on the input timing of the sensor pulses for M=3and M=4, the pulse interval T₃ is calculated at a block 2030. The pulseinterval T₃ derived at the block 2030 is then written into the firstpulse interval storage of the pulse interval memory. At the same time,the pulse interval data T₂ previously stored in the first pulse intervalstorage is transferred to another storage section of the pulse intervalmemory adapted to store previous pulse interval data. This other storagesection will be hereafter referred to as "second pulse intervalstorage". Subsequently, at a block 2032 the contents of the first andsecond storages, i.e. the pulse interval data T₂ and T₃ are read out.Based on the read out pulse interval data T₂ and T₃, a pulse intervaldifference dT is calculated at block 2032 and compared with the pulseinterval threshold S to determine whether or not the pulse intervaldifference dT is large enough for accurate calculation of wheelacceleration or deceleration a_(w). If so, process goes to the block2040 to calculate the wheel acceleration or deceleration according tothe equation (1). The register value N is then set to 1 at the block2044 and thus MODE 1 is selected. In addition sample period number M isreset to -1, and the a_(w) derivation cycle starts again. On the otherhand, if at the block 2032 the pulse interval difference dT is too smallto calculate the wheel acceleration or deceleration a_(w), then thevalue N is multiplied by 2 at a block 2034. Due the updating of thevalue N, the sample mode of the sensor pulses is shifted to the nextmode.

When the block 2034 is performed and thus the sample mode is shifted toMODE 2 with respect to the sensor pulse of M=4', the sensor pulse c₂input following to the sensor pulse of M=4' is ignored. The sensor pulsec₃ following to the ignored sensor pulse c₂ is then taken as the sensorpulse to be sampled as M=3". At this time, the sensor pulse of M=4' istreated as the sensor pulse of M=2" and the sensor pulse of M=2 istreated as the sensor pulse of M=1". Therefore, calculation of theinterval difference dT and discrimination if the derived intervaldifference dT is greater than the pulse interval threshold S in theblock 2032 will be carried out with respect to the sensor pulse c₃ whichwill be treated as the sensor pulse of M=4". The blocks 2032 and 2034are repeated until the interval difference greater than the pulseinterval threshold S is obtained. The procedure taken in each cycle ofrepetition of the blocks 2032 and 2034 is substantially same as that setforth above.

As set forth above, by setting the counter value NC of the auxiliarycounter 233 to 1 at the block 2016, the input timing of the sensor pulsereceived immediately after initially deriving the sample mode at theblocks 2010 and 2012 will be sampled as the first input timing to beused for calculation of the wheel acceleration and deceleration. Thismay be contrasted with the procedure taken in the known art.

FIG. 18 shows timing of calculation of the wheel acceleration anddeceleration in comparison with the calculation timing of the wheelacceleration and deceleration in the prior art. As will be appreciatedfrom FIG. 18, in the prior art, after deriving the sample mode so thatthe pulse interval T_(s) is longer than the reference value, e.g. 4 ms,the first sensor pulse A' is sampled after thinning the correspondingnumber of sensor pulses e.g. 3 sensor pulses in the shown case. On theother hand, the first sensor pulse A, according to the presentinvention, can be sampled with respect to the sensor pulse inputimmediately after deriving the sample mode. As will be appreciatedherefrom, sample timing according to the present invention is fasterthan that in the prior art so that calculation of the wheel accelerationand deceleration can be performed at an earlier timing than that in theconventional art. In other words, the time lag of wheelacceleration/deceleration calculation due to sensor pulse grouping canbe shortened.

FIG. 17 shows a modified procedure can be taken for obtaining theinterval difference dT larger than the pulse interval threshold S. Inthis modification, SUB-MODE as illustrated is used instead of performingthe block 2034 to shift the sample mode of FIG. 16.

In this modification, when MODE 3 is selected during execution of themain routine of FIG. 15, at the blocks 2010, 2012 and 2016, thecontroller unit 202 is operating under MODE 3, first the sensor pulsesA₁ ', B₁ ' and C₁ ' are sampled as shown in FIG. 17. The pulse intervaldifference between (C₁ '-B₁ ') and (B₁ '-A₁ ') is calculated in responseto the sensor pulse C₁ ' (M=4). This operation for detecting theinterval difference dT larger than the pulse interval threshold S issubstantially corresponding to the operation at the blocks 2032, in themain routine of FIG. 15. If the determined pulse interval difference dTis equal to or greater than the pulse interval threshold S, the wheelacceleration or deceleration will be calculated using the derived pulseinterval difference dT (SUB-MODE 1) at the block 2040 of the mainroutine of FIG. 15. On the other hand, if the derived pulse intervaldifference dT is less than the pulse interval threshold S, the sensorpulses A₂ ' (=A₁ ': M=2), B₂ ' (=C₁ ': M=4) and C₂ ' (M=6) are sampledin SUB-MODE 2. If the pulse interval difference derived from the inputtiming of A₂ ', B₂ ' and C₂ ' is less than the pulse interval thresholdS, then the controller unit 202 shifts the operation mode into SUB-MODE3 in which the sensor pulses A₃ ' (=A₁ '=A₂ ': M=2), B₃ ' (=C₂ ': M=6)and C₃ ' (M=10) are sampled.

In both of SUB-MODEs 2 and 3, calculation for deriving the wheelacceleration or deceleration a_(w) relative to the sensor pulses M5, M6,M7, M8 and M9 are performed with taking the input timing of twoproceeding sensor pulses similarly to the procedure performed atSUB-MODE 1 when the interval difference dT larger than the pulseinterval threshold S can be detected with respect to M7, M8 or M9, forexample.

As will be appreciated herefrom, SUB-MODE referred to hereabove meanfurther variations of the sensor pulse sample mode in order to obtainthe interval difference dT greater than the pulse interval threshold Sfor enabling calculation of the wheel acceleration and deceleration atthe block 2040 of the main routine of FIG. 15. With the foregoingmodification of FIG. 17, even when the interval difference dT greaterthan the pulse interval threshold S is obtained with respect to thesensor pulse which has to be thinned under the procedure of FIG. 16, thewheel acceleration and deceleration can be derived for reducing losstime. Further, according to this modified procedure, the calculationtiming of the wheel acceleration and deceleration can follow relativelyabrupt change of the wheel speed.

FIG. 19 shows the sample control program stored in the memory block 250of ROM 238. This sample control program is executed when the sample flagFL reaches a predetermined value. In the shown embodiment, the samplecontrol program is executed when the sample flag value FL equals 2. Whenthe sample flag value FL=2 at the block 1004 in FIG. 13, then the samplecontrol program is executed to multiply the auxiliary counter value N by2, at a block 4002 of FIG. 19. At the same time, the auxiliary countervalue NC is set to 1. Thereafter, the sample flag is reset to zero at ablock 4004.

The sample control program of FIG. 19 provides a quick and simpleadjustment of the sampling mode for both initial start-up and caseswhere the wheel accelerates so quickly that two sampling periods arecompleted within a single acceleration rate a_(w) derivation cycle.Setting N equal to 2N in block 4002 doubles the sample size and soeffectively doubles the sample period and setting NC to 1 ensures thatthe sampling will restart immediately with the next sensor pulse.

FIG. 20 shows the timer overflow program stored in the memory block 252of ROM. As set forth above, the clock counter 259 used in the shownembodiment has the capacity to count the clock pulses from the clockgenerator 11 for 62 ms. Therefore, the timer overflow program isexecuted as an interrupt program whenever the counter value of the clockcounter 259 reaches its maximum value (counter is full counted), i.e.every 64 ms. Upon starting execution of the timer overflow program, thetimer overflow value OFL is incremented by 1, at a block 4010. Theoverflow value OFL is then checked at a block 4012. If the overflowvalue OFL is less than a given value, e.g. 2, then control returns tothe main routine of the main program. Since the timer overflow value OFLis cleared at the end of the main program at the block 1008, if thetimer overflow program is executed twice during one cycle of executionof main program, the overflow value OFL would become 2. In this case,the answer at the block 4012 would be YES and the wheel speed valueV_(w) would be set to zero and the wheel acceleration and decelerationvalue a_(w) would also be set to zero.

For instance, if three successive sensor pulses are produced within theperiod of time for which the clock counter 259 counts the clock pulsesfrom the clock signal generator, as shown in FIG. 21, the input timingof respective sensor pulses may be as shown at A, B and C, correspondingto the counter values C_(A), C_(B) and C_(C). The overflow value OFLremains at zero in response to each of the sensor pulses A, B and C,since the sensor pulses are received before the counter time elapses.Therefore, the first time the timer overflow program is executed afterreceiving the sensor pulse C, the timer overflow value is incremented by1 during execution of the timer overflow program at the block 4010. Inthis case, the timer overflow value OFL is still only 1 which is smallerthan the limit checked for at the block 4012. On the other hand, if thesensor pulses are produced at intervals relatively long so that thetimer overflow program can be executed twice before three successivesensor pulses are sampled, as shown in FIG. 23, then the wheel is movelyso slowly that wheel acceleration a_(w) can not be reliably calculated.

Therefore, in the timer overflow program, as shown in FIG. 20, the wheelspeed V_(w) and the wheel acceleration or deceleration a_(w) are set tozero at the block 4014. By setting both the wheel speed V_(w) and thewheel acceleration and deceleration a_(w) to zero, serious errors willbe avoided.

FIG. 23 shows the output program for deriving the wheel speed V_(w),wheel acceleration and deceleration a_(w) and slip rate R, selecting theoperational mode, i.e. application mode, hold mode and release mode andoutputting an inlet signal EV and/or an outlet signal AV depending uponthe selected operation mode of the actuator 16.

When the application mode is selected the inlet signal EV goes HIGH andthe outlet signal EV goes HIGH. When the release mode is selected, theinlet signal EV goes LOW and the outlet signal AV also goes LOW. Whenthe selected mode is hold mode, the inlet signal EV remains HIGH whilethe outlet signal AV goes LOW. These combinations of the inlet signal EVand the outlet signal AV correspond to the actuator supply currentlevels shown in FIG. 11 and thus actuate the electromagnetic valve tothe corresponding positions illustrated in FIGS. 4, 5 and 6.

The output program is stored in the memory block 254 and adapted to beread out periodically, e.g. every 10 ms, to be executed as an interruptprogram. The output calculation program is executed in the time regionsshown in hatching in FIGS. 24 and 25.

During execution of the output calculation program, the pulse interval Tis read out from a memory block 241 of RAM which stores the pulseinterval, at a block 5002. As set forth above, since the pulse intervalT is inversely proportional to the wheel rotation speed V_(w), the wheelspeed can be derived by calculating the reciprocal (1/T) of the pulseinterval T. This calculation of the wheel speed V_(w) is performed at ablock 5004 in the output program. After the block 5004, the target wheelspeed V_(i) is calculated at a block 5006. The manner of deriving thetarget wheel speed V_(i) has been illustrated in the U.S. Pat. Nos.4,392,202 to Toshiro MATSUDA, issued on July 5, 1983, 4,384,330 also toToshiro MATSUDA, issued May 17, 1983 and 4,430,714 also to ToshiroMATSUDA, issued on Feb. 7, 1984, which are all assigned to the assigneeof the present invention. The disclosure of the above-identified threeUnited States Patents are hereby incorporated by reference for the sakeof disclosure. As is obvious herefrom, the target wheel speed V_(i) isderived as a function of wheel speed deceleration as actually detected.For instance, the wheel speed V_(w) at which the wheel decelerationa_(w) exceeds the deceleration threshold a_(ref), e.g. -1.2 G is takenas one reference point for deriving the target wheel speed V_(i). Thewheel speed which the wheel deceleration a_(w) also exceeds thedeceleration threshold a_(ref), is taken as the other reference point.In addition, the period of time between the points a and b is measured.Based on the wheel speed V_(w1) and V_(w2) and the measured period P,the deceleration rate dV_(i) is derived from:

    dV.sub.i =(V.sub.w1 -V.sub.w2)/P                           (4)

This target wheel speed V_(i) is used for skid control in the next skidcycle.

It should be appreciated that in the first skid cycle, the target wheelspeed V_(i) cannot be obtained. Therefore, for the first skid cycle, apredetermined fixed value will be used as the target wheel speed V_(i).

At a block 5008, the slip rate R is calculated according to theforegoing formula (2). Subsequently, the operational mode is determinedon the basis of the wheel acceleration and deceleration a_(w) and theslip rate R, at a block 5010. FIG. 26 shows a table used in determiningor selecting the operational mode of the actuator 16 and which isaccessed according to the wheel acceleration and deceleration a_(w) andthe slip rate R. As can be seen, when the wheel slip rate R is in therange of 0 to 15%, the hold mode is selected when the wheel accelerationand deceleration a_(w) is lower than -1.0 G and the application mode isselected when the wheel acceleration and deceleration a_(w) is in therange of -1.0 G to 0.6 G. On the other hand, when the slip rate Rremains above 15%, the release mode is selected when the wheelacceleration and deceleration a_(w) is equal to or less than 0.6 G, andthe hold mode is selected when the wheel acceleration and decelerationis in a range of 0.6 G to 1.5 G. When the wheel acceleration anddeceleration a_(w) is equal to or greater than 1.5 G, the applicationmode is selected regardless of the slip rate.

According to the operational mode selected at the block 5010, the signallevels of the inlet signal EV and the outlet signal AV are determined sothat the combination of the signal levels corresponds to the selectedoperation mode of the actuator 16. The determined combination of theinlet signal EV and the outlet signal AV are output to the actuator 16to control the electromagnetic valve.

It should be appreciated that, although the execution timing of theoutput calculation program has been specified to be about 10 ms in theforegoing disclosure, the timing is not necessarily fixed to thementioned timing and may be selectable from the approximate range of 1ms to 20 ms. The execution timing of the output program is fundamentalyto be determined in accordance with the response characteristics of theactuator.

FIGS. 27A and 27B show in detail the circuitry of the preferredembodiment of anti-skid control system with a fail-safe system inaccordance with the present invention. Each of the controllers 202, 204and 206 has an output terminal P₁ connected to a power transistor Tr₁₀,Tr₁₁ or Tr₁₂ which turns ON and OFF depending upon the output level atthe output terminal P₁. The collector electrode of each of the powertransistors Tr₁₀, Tr₁₁ and Tr₁₂ is connected to a coil 16a, 18a and 20ain the actuator 16, 18 and 20. The coils 16a, 18a and 20a of theactuators 16, 18 and 20 are commonly connected to a vehicle battery 300through a fuse 302 and a relay circuit 304 which performs a fail-safeoperation to be explained later when the anti-skid controllermalfunctions. Surge-absorbing Zener diodes Z₁, Z₂ and Z₃ are connectedto the collector electrodes of the power transistors Tr₁₀, Tr₁₁ and Tr₁₂respectively.

The battery 300 is also connected to supply battery voltage +Eb to avoltage regulator 306 through an ignition switch 308. The resultingregulated voltages +E is supplied to the various components of theanti-skid control system.

In the shown embodiment, the EV signals are output through the outputterminals P₁ of the controllers 202, 204 and 206. On the other hand, thecontrollers 202, 204 and 206 each have a output terminal P₂ outputtingthe corresponding AV signal. The output terminals P₂ of the controllers202, 204 and 206 are connected to coils 16b, 18b and 20b of theactuators 16, 18 and 20 respectively via power transistors Tr₁₀ ', Tr₁₁' and Tr₁₂ ' associated with Zener diodes Z₁ ', Z₂ ' and Z₃ '. The coils16b, 18b and 20b are also connected in parallel to the battery 300through the fuse 302 and the relay circuit 304.

The collector electrodes of the power transistors Tr₁₀, Tr₁₁ and Tr₁₂are also connected to negative input terminals of comparators 310, 312and 314 respectively which comprise differential amplifiers. Thepositive input terminals of the comparators 310, 312 and 314 are allconnected to corresponding reference signal generators which monitors ofthe voltage at the corresponding collector electrodes of the powertransistors Tr₁₀, Tr₁₁ and Tr₁₂ and produce HIGH-level reference signalswhen a HIGH-level voltage at the collector electrode of thecorresponding power transistor is detected. Although not fullyillustrated in FIG. 27, the transistors Tr₁₀ ', Tr₁₁ ' and Tr₁₂ ' arealso connected to corresponding comparators which, in turn are connectedto reference signal generators operating similarly to those connected tothe comparators 310, 312 and 314. These comparators form a comparatorcircuit 311 in conjunction with the comparators 310, 312 and 314. Eachcomparator 310, 312 and 314 is connected to a timer circuit 316, 318 and320 respectively, which is triggered by a HIGH-level comparator outputfrom the corresponding comparator 310, 312 and 314 to measure the periodfor which the comparator signal remains HIGH. If the measured timeexceeds a predetermined limit, the timers 316, 318 and 320 output anabnormal state-indicative signal to an OR gate 322. The comparators 310,312 and 314 are also connected for output to an AND gate 324 which alsoreceives an input from an actuator-monitoring circuit 326. Theactuator-monitoring circuit 326 comprises transistors Tr₁₇, Tr₁₈ andTr₁₉, the base electrodes of which are connected to the collectorelectrodes of the power transistors Tr₁₀, Tr₁₁ and Tr₁₂, via resistors328, 330 and 332 respectively. Collector electrodes of the transistorsTr₁₇, Tr₁₈ and Tr₁₉ are connected for input to the AND gate 324 viadiodes D₂, D₃ and D₄ and a common line 334. The resistances of theresistors 328, 330 and 332 are selected to be sufficiently greater thanthe resistance of the coils 16a, 18a, 20a. Although theactuator-operation monitoring circuit 326 is shown in FIG. 27 to bemonitoring only the lines from the output terminals P₁ to the coils 16a,18a and 20a, it should be appreciated that it also monitors the linesfrom the output terminals P₂ to the coils 16b, 18b and 20b.

The output terminal of the AND gate 324 is connected to a timer 336which is triggered by a HIGH-level output from the AND gate 324 tomeasure the period for which the output of the AND gate 324 remainsHIGH. The timer 336 outputs a HIGH-level timer signal when the measuredelapsed time reaches a predetermined time. The timer signal is sent toone of the input terminals of an OR gate 344.

It should be apprecaited that the AND gate 336 serves to preventerroneous detection of actuator malfunction, i.e. an open circuit in thecoils. When the transistors Tr₁₀, Tr₁₀ ', Tr₁₁, Tr₁₁ ', Tr₁₂ and Tr₁₂ 'turn ON in response to HIGH-level inputs to their base electrodes fromthe various output terminals P₁ and P₂, the input level at the baseelectrodes of the transistors in the actuator-monitoring circuit 326,i.e. of transistors Tr₁₇, Tr₁₈ and Tr₁₉, go LOW, allowing the voltage attheir collector electrodes to rise. As a result, the input level at theinput terminal of the AND gate 324 from the actuator-monitoring circuit326 goes HIGH. However, at the same time, the comparators in thecomparator circuit 311, i.e. 310, 312, 314 output LOW-level comparatorsignals due to the HIGH-level inputs at their negative input terminals.Therefore, the AND condition of the AND gate 324 is not established, andthe output level of the AND gate remains LOW.

The AND gate 324 is connected for input from a power supply monitoringcircuit 338 through an inverter 340, in which power supply monitoringcircuit 338 a transistor Tr₁₆ is conductive barring an open circuit in arelay coil 304a in the relay circuit 302, failure of a transistor Tr₁₄or blowing of fuse 302, in other words, as long as the power supply isintact. If the power supply fails due to one of these conditions, thevoltage at the collector of transistor Tr₁₆ goes HIGH, so that the inputto AND gate 324 via inverter 340 goes LOW, preventing a HIGH-leveloutput. Therefore, if the power supply to the coils of the actuators 16,18 and 20 should fail, the AND gate 324 would not erroneously signal anactuator hardware failure.

The timer 336 and the OR gate 322 are both connected for output to an ORgate 344. Another of the input terminal of the OR gate 344 is connectedvia another OR gate 346 to the output terminals P₃ of the controllers202, 204 and 206 via an OR gate 345. The output terminal P₃ of thecontroller 202 is also connected to an input terminal P₄ of thecontroller 204. The output terminal P₃ of the controller 204 isconnected to an input terminal P₄ of the controller 206. The outputterminal P₃ of the controller 206 is connected to the input terminal P₄of the controller 202. The output terminals P₃ outputs fault-indicativesignals when malfunction of the controller or the sensors is detected.Each of the controllers 202, 204 and 206 is responsive to the input ofthe fault-indicative signal through the input terminal P₄ from theoutput terminal P₃ of the associated controller to provide the fail-safeoperation.

The OR gate 344 also receives an input from a timer 348 which, in turn,receives input from the collector electrode of the transistor Tr₁₆ ofthe power supply monitoring circuit 338 via an AND gate 350. The otherinput terminal of the AND gate 350 is connected to the inverted outputterminal Q of a flip-flop 352 described later. The OR gate 344 alsoreceives input from another timer 354 which is, in turn, receives inputvia a NOR gate 356 from the positive-biased collector of a transistorTr₁₅ in a motor-monitoring circuit 358. The motor-monitoring circuit 358comprises the transistor Tr₁₅, a diode D₁ and resistors R₁ to R₃. Thebase electrode of the transistor Tr₁₅ is connected to the motor 88 ofthe fluid pump 90 via the diode D₁ and resistor R₂. The motor 88 is, inturn, connected to the battery 300 via a fuse 360 and a relay circuit362.

The OR gate 344 receives one other input from a faulty condition memory366 consisting of SET/RESET flip-flops (RS-FF's) 368, 370, 372, 374,376, 378, 380 and 382. In the shown embodiment, the last input terminalof the OR gate 344 is connected in common to the RS-FF's 378, 380 and382 via diodes D₇, D₈ and D₉.

The output terminal of the OR gate 344 is connected to a disableterminal of the controllers 202, 204, 206 and a set input terminal (S)of the flip-flop 352. The output terminal of the OR gate 344 is alsoconnected to the input terminal. Under normal conditions, the flip-flop352 remains in its reset state, in which the output at its invertedoutput terminal Q turns ON a transistor Tr₁₄ which in turn energizes therelay coil 304a of the relay circuit 304. The inverted output terminal Qof the flip-flop 352 is also connected to one of the input terminals ofthe AND gate 350 to supply a HIGH-level input enabling the AND gate 350to monitor the power supply. On the other hand, the positive outputterminal Q of the flip-flop 352 is connected to illuminate a faultmonitor lamp 384 via a transistor Tr₂₀. The base electrode of thetransistor Tr₂₀ is connected to a differentiation circuit 386 comprisinga capacitor C₁ and a resistor R₁₁ connected in parallel to outputterminal Q. This differentiation circuit 386 is temporarily activated bythe regulated power source +E when the power supply is first started totemporarily turn ON the transistor Tr₂₀ and so illuminate the faultmonitor lamp 384.

The RS-FF 368 of the fault memory 366 is connected for input from thetimer 336. The RS-FF 370 is connected for input from the OR gate 322.The RS-FF 372 is connected for input from the timer 348. The RS-FF 374is connected for input from the timer 354. The RS-FF 376 is connectedfor input from a battery voltage monitoring circuit 388. The batteryvoltage monitoring circuit 388 includes differential amplifiers 390 and392. The non-inverting and inverting input terminals of the differentialamplifiers 390 and 392 respectively are connected to receive a voltagewhich is derived from the battery voltage +E_(b) by the voltage-dividingresistor R₆ and R₇. The inverting terminal of the differential amplifier390 receives a reference voltage V_(a) which is obtained by dividing theregulated voltage by resistors R₈ and R₉. Similarly, a reference voltageVc obtained by dividing the regulated voltage E, specifically from thetap between serial-connected resistors R₈ and R₉ and resistor R₁₀, isapplied to the non-inverting input terminal of the differentialamplifier 392. This pair of differential amplifiers checks forabnormally high or low battery voltages. The RS-FF 378 of the faultmemory 366 is connected to a wheel speed comparator 394 in a wheel speedsensor monitoring circuit 396. The RS-FF 380 is connected to anotherwheel speed comparator 398 of the wheel speed sensor monitoring circuit396. The RS-FF 382 is connected to a circuit breaking detector 400, thefunction of which will be explained in detail later.

Each of the RS-FF's 368, 370, 372, 374, 376, 378, 380 and 382 isconnected to an indicator L_(a), L_(b), L_(c), L_(d), L_(e), L_(f),L_(g) and L_(h) via a switching transistor T_(a), T_(b), T_(c), T_(d),T_(e), T_(f), T_(g) and T_(h). The indicators L_(a), L_(b), L_(c),L_(d), L_(e), L_(f), L_(g) and L_(h) are connected to the battery 300via the fuse 402 and the ignition switch 308.

The controller 206 has an output terminal MR which is connected to afluid pump 88 driver circuit 404 including a transistor Tr₁₃ and a Zenordiode Z₄.

The operation of the preferred embodiment of the fail-safe system forthe anti-skid brake control system according to the present inventionwill be described herebelow in terms of the operation of each of thefault-monitor circuits set forth above.

MOTOR-OPERATION MONITORING CIRCUIT 358

The motor-operation monitoring circuit 358 normally supplies very littlecurrent to the motor due to diode D₁ and a only a low-level voltage viaresistors R₁ and R₂ to the base of transistor Tr₁₅. Thus, in the normalstate, the supplied current is too small to drive the motor 88 but theremaining voltage is insufficient to render the transistor Tr₁₅conductive. However, if the motor circuit should be damaged or broken,the regulator voltage +E will be applied to the base electrode of thetransistor Tr₁₅ via the resistors R₁ and R₂. As a result, the collectorelectrode of the transistor Tr₁₅ will be grounded, causing a LOW-levelinput to the NOR gate 356. The other input terminal of the NOR gate 356is connected to the output terminal MR of the controller 206 throughwhich the motor driver signal is output to the motor relay 362.

The LOW-level signal from the transistor Tr₁₅ in the absence of themotor driver signal from terminal MR causes the NOR gate 356 to output aHIGH-level signal. On the other hand, when the motor driver signal isoutput by the output terminal MR of the controller 206, the input levelof the NOR gate terminal connected to the output terminal MR goes HIGH.At the same time, due to energization of the relay coil 362a of themotor relay 362, the motor 88 is driven by power supply through themotor relay 362 from the battery 300. Due to the supply of battery powerto the motor, the diode D₁ is biased to block electrical communicationfrom the regulator 306 to the motor 88. As a result, the input level atthe base electrode of the transistor Tr₁₅ goes HIGH to render itconductive. Thus, the transistor Tr₁₅ sends a HIGH-level signal to theNOR gate 356. In this case, since both of the inputs to the NOR gate 356are HIGH, the output of the NOR gate 356 remains LOW.

As will be appreciated herefrom, the NOR gate 356 outputs a HIGH-levelsignal only when the transistor Tr₁₅ is conductive and the motor driversignal is not output.

The output terminal of the NOR gate 356 is connected to the timer 354.The timer 354 is triggered by a HIGH-level output from the NOR gate tostart measuring the time for which the NOR gate output remains HIGH. Ifthe NOR gate output goes LOW before a predetermined period of timeexpires, the timer is reset. On the other hand, if the measured elapsedtime reaches the given period of time, the timer 354 outputs aHIGH-level timer signal indicative of motor failure. The faultymotor-indicative timer signal is input to the OR gate 344, causing theOR gate to output a HIGH-level signal. The HIGH-level output from the ORgate 344 sets the flip-flop 352 which in turn turns the monitor lamp 384on due to a ground connector via the transistor Tr₂₀ which is turned ONby the HIGH-level flip-flop output. On the other hand, the transistorTr₁₄ is turned OFF to deenergize the relay coil 304a of the relaycircuit 304. As a result, battery 300 is disconnected from the actuatorscoils 16a, 16b, 18a, 18b, 20 a and 20b.

At the same time, the faulty motor-indicative timer signal from thetimer 354 is input to the RS-FF 374 to set the latter. This alsoactivates the transistor T_(d) so as to illuminate the indicator L_(d).

It should be appreciated that the timer 354 serves to enforce a delaytime before response to the HIGH-level output from the NOR gate. This isbelieved to effectively prevent erroneous detection of motor failurewhich may otherwise occur due to normal delays in the response of themotor to onset and termination of its operation after changes in thelevel of the output from the output terminal MR.

POWER SUPPLY MONITORING CIRCUIT 338

In the normal state wherein the flip-flop 352 is reset so as to activatethe transistor Tr₁₄ and accordingly the relay coil 304a of the relaycircuit 304. Under these conditions, HIGH-level battery voltage isapplied to the base electrode of the transistor Tr₁₆ in the power supplymonitoring circuit 338. The transistor Tr₁₆ is thus turned ON to apply aLOW-level input to one of the input terminals of the AND gate 350. Theother input terminal of the AND gate 350 receives the inverted output Qof the flip-flop 352. In the normal state, the flip-flop 352 is reset sothat a HIGH-level signal is output through the inverted output terminal.Therefore, under normal conditions, the input level at the other inputterminal of the AND gate is held HIGH.

If the battery power supply is blocked by a blown fuse 302, failure ofrelay circuit 304 or a short circuit in one of the actuator coils 16a,16b, 18a, 18b, 20a or 20b, the transistor Tr₁₆ turns OFF, allowing aHIGH-level voltage to accumulate at its collector electrode. As long asthe flip-flop 352 is reset, the input level at the other input terminalof the AND gate 350 is HIGH, as set forth above. Therefore, when thecollector voltage of the transistor Tr₁₆ goes HIGH, so does the outputof the AND gate 350. The timer 348 is triggered by the HIGH-level outputof the AND gate to start measuring the time for which the output of theAND gate remains HIGH. If a given period of time expires before the ANDgate output goes LOW, the timer outputs a HIGH-level faulty powersupply-indicative timer signal to the OR gate 344. This causes theoutput level of the OR gate 344 to go HIGH and set the flip-flop 352. Asa result, the monitor lamp 384 is turned ON and the relay coil 304a ofthe relay circuit 304 is deenergized.

At the same time, the HIGH-level faulty power supply-indicative timersignal from the timer 348 is sent to the RS-FF 372. The RS-FF 372 is setby the HIGH-level faulty power supply-indicative timer signal to turnthe transistor T_(c) ON and thereby turns the indicator L_(c) ON.

If the relay coil 304a is deenergized to prevent power supply to theactuator coils for some other reason during fail-safe operation, theinput to the AND gate from the inverted output terminal of the flip-flop352 goes LOW. Therefore, in this case, even though the transistor Tr₁₆is turned OFF due to interruption of the power supply via the relaycircuit 304, erroneous detection by the power supply monitoring circuit338 is satisfactorily and successfully prevented.

On the other hand, the timer 348 prevents the power supply monitoringcircuit from erroneously indicating failure of the power supply when theignition switch 308 to first closed. The time limit of the timer 348must be longer than the greatest possible response lag of the relaycircuit 304 to closure of the ignition switch 308.

COMPARATOR CIRCUIT 311

The comparator circuit 311 serves to monitor the outputs of thecontrollers 202, 204 and 206 and of the transistors Tr₁₀, Tr₁₀ ', Tr₁₁,Tr₁₁ ', Tr₁₂ and Tr₁₂ '. The transistors Tr₁₀ to Tr₁₂ ' are renderedconductive in response to HIGH-level outputs from the correspondingoutput terminals of the controllers 202, 204 and 206. The collector ofeach of the transistors is connected to the inverting input terminal ofthe corresponding differential amplifier 310, 310', 312, 312', 314 or314'. On the other hand, the non-inverting input terminals of thedifferential amplifiers receive a corresponding reference signal whichgoes HIGH in response to LOW-level input to the base of thecorresponding transistor. Therefore, the output of a differentialamplifier goes HIGH only when the corresponding transistor is turned OFFbut the voltage level at its collector remains low due to somemalfunction. Each of the timers 316, 316', 318, 318', 320 and 320' isresponsive to a HIGH-level output from the corresponding differentialamplifier to start measuring the time for which the output level of thecorresponding differential amplifier remains HIGH. When the measuredelapsed time reaches a given period of time, the timer produces aHIGH-level faulty control signal-indicative timer signal. The faultycontrol signal-indicative timer signal sets the flip-flop 352 via ORgates 322 and 344 to deenergize the relay coil 304a and so terminatepower supply to the actuator coils 316a, 316b, 318a, 318b, 320a and320b. At the same time, the set output of the flip-flop 352 lights upthe monitor lamp 384.

As set forth above, the transistors Tr₁₀ to Tr₁₂ ' are renderedconductive by HIGH-level outputs from the corresponding output terminalsP₁ and P₂ of the controllers 202, 204 and 206 to energize thecorresponding actuator coils 16a, 16b, 18a, 18b, 20a and 20b. On theother hand, as mentioned above, when the EV signal output through the P₁output terminal and the AV signal output through the P₂ output terminalare both HIGH, the system operates in RELEASE mode. When a HIGH-level EVsignal is output through the P₁ output terminal and a LOW-level AVsignal is output through the P₂ output terminal, the system operates inHOLD mode. Therefore, the output states of each pair of transistors Tr₁₀to Tr₁₂ ' reflect the operating mode, i.e. RELEASE and HOLD modes, ofthe corresponding brake circuit.

A fail-monitor 406 monitors operation of the controllers 202, 204 and206. The fail-monitor 406 is connected to the controllers 202, 204 and206 to receive a program run signal which is output at regular intervalsas long as the controller is operating normally. If the interval betweensuccessive program run signals exceeds a preset period of time, thefail-monitor 406 outputs a reset signal to the controller 202, 204 and206 to re-initialize the controllers and restart all control operations.Thereafter, if the interval between successive program run signals againexceeds the preset period of time, the fail-monitor 406 outputs anabnormal state-indicative signal to the OR gate 322.

The fail-monitor 406 may be the watch-dog timer disclosed in U.S. Pat.No. 4,363,092 to ABO et al. The contents of the above-identified U.S.Patent are hereby incorporated by reference for the sake of disclosure.

ACTUATOR-MONITORING CIRCUIT 326

The transistors Tr₁₇, Tr₁₇ ', Tr₁₈, Tr₁₈ ', Tr₁₉ and Tr₁₉ ' are adaptedto be turned OFF by HIGH voltage levels at the bases of thecorresponding transistors Tr₁₀, Tr₁₀ ', Tr₁₁, Tr₁₁ ', Tr₁₂ and Tr₁₂ '.If any one of the transistors Tr₁₇ through Tr₁₉ ' is nonconductive, thecombined output of the actuator-monitoring circuit 326 goes HIGH. Theoutput of the actuator-monitoring circuit 326 is sent to the AND gate324, another input terminal of which is connected to the collectorelectrode of the transistor Tr₁₆ of the power supply-monitoring circuit338 via the inverter 340. The other input terminals of the AND gate areconnected to the differential amplifiers 310 through 314' via an OR gate315.

When the transistor Tr₁₀ is turned ON by a HIGH-level output from thecontroller 202, the input level at the base electrode of the transistorTr₁₇ goes LOW. As a result, a HIGH-level voltage develops at thecollector electrode of the transistor Tr₁₇, i.e. at the output of theactuator-monitoring circuit 326. In this case, since the voltage at thecollector of the transistor Tr₁₀ remains LOW, the output level of thedifferential amplifier 310 also remains LOW. Therefore, in this case,the AND gate 324 outputs a LOW-level signal due to the LOW-level inputfrom the differential amplifier 310 via the OR gate 315 despite the factthat, since the power supply is connected to the actuator coils 16a,16b, 18a, 18b, 20a and 20b to activate the transistor Tr₁₆ the input tothe AND gate 324 from the invertor 340 remains HIGH.

However, if an actuator coil 16a is damaged and thus the circuitconnecting the battery to the transistor Tr₁₀ is open, the input levelat the base electrode of the transistor Tr₁₇ remains LOW even when thetransistor Tr₁₀ is turned OFF by a LOW-level output from the controller202. As a result, a HIGH-level signal is input to the AND gate 324 fromthe transistor Tr₁₇ via the diode D₂. In this case, since the transistorTr₁₀ is turned OFF, the voltage level at the collector electrode of thetransistor Tr₁₀ goes HIGH to provide a HIGH-level input to the AND gate324 via the OR gate 315. Since the input through the inverter 340remains HIGH as long as the power supply continues, the "AND" conditionsof the AND gate 324 are satisfied. Thus, the AND gate 324 outputs aHIGH-level gate signal to the timer 336. The timer 336 is triggered bythe HIGH-level gate signal to start measuring the time for which thegate signal remains HIGH. The timer 336 outputs a HIGH-level faultyactuator-indicative timer signal if the measured time exceeds apredetermined period of time. As a result, the output level of the ORgate 344 goes HIGH to set the flip-flop 352. As a result, the monitorlamp 384 is turned ON and the relay coil 304a of the relay circuit 304is deenergized.

At the same time, the faulty actuator-indicative timer signal of thetimer 336 is also applied to the RS-FF 368 to set the latter. As aresult, the transistor T_(a) is turned ON to turn ON the indicatorL_(a).

In a similar manner, the operation of all of the actuator coils 16b,18a, 18b, 20a and 20b is monitored.

It should be appreciated that when the power supply to the actuatorcoils is interrupted, the input from the actuator-operation monitoringcircuit 326 goes HIGH even if the transistors Tr₁₀ to Tr_(12') areconductive. However, at the same time, the transistor Tr₁₆ remainsnonconductive, resulting in a HIGH-level voltage at its collectorelectrode. Therefore, input to the AND gate 324 via the invertor 340goes LOW. Therefore, if the transistors of the actuator-operationmonitoring circuit 326 are deactivated due to failure of the powersupply, the faulty actuator-indicative signal will not be produced.

BATTERY VOLTAGE MONITORING CIRCUIT 388

The non-inverting input terminal of the differential amplifier 390 ofthe battery voltage monitoring circuit 388 is connected for input fromthe battery 300 via the fuse 360 and via the resistor R₆. The invertinginput terminal of the differential amplifier 392 is also connected tothe battery 300 via the fuse 360 and the resistor R₆. The referencevoltage V_(b) applied to the inverting input terminal of thedifferential amplifier 390 has a voltage representing an upper batteryvoltage limit. The reference voltage V_(c) applied to the non-invertinginput terminal of the differential amplifier 392 represents a lowerbattery voltage limit. If the battery voltage becomes abnormally high,the output of the differential amplifier 390 goes HIGH. On the otherhand, if the battery voltage drops below the lower limit, the output ofthe differential amplifier 392 goes HIGH. A HIGH-level output fromeither of the differential amplifiers 390 and 392 will be referred to asan abnormal battery voltage-indicative signal.

The abnormal battery voltage-indicative signal will be transmitted bythe OR gate 344 to set the flip-flop 352. As a result, the monitor lamp384 turns ON and the relay coil 304a of the relay circuit 304 isdeenergized. At the same time, the abnormal battery voltage indicativesignal is sent to RS-FF 376 to set the latter. As a result, thetransistor T_(f) turns ON and the indicator L_(f) turns ON.

WHEEL SPEED SENSOR MONITORING CIRCUIT 396

The comparator 394 receives wheel speed-indicative signals from thecontrollers 202 and 204. The comparator 398 receives the wheelspeed-indicative signals from the controllers 204 and 206. The circuitbreaking detector 400 is connected to the wheel speed sensor 10b. Theoutputs of the comparators 394 and 398 and the circuit breaking detector400 identify faulty wheel speed sensors according to the followingtable:

                  TABLE                                                           ______________________________________                                        Faulty Sensor                                                                            394 Output  398 Output                                                                              400 Output                                   ______________________________________                                        Normal     LOW         LOW       LOW                                          10a        HIGH        LOW       LOW                                          10b        HIGH        HIGH      HIGH                                         10c        LOW         HIGH      LOW                                          10a & 10b  LOW         HIGH      HIGH                                         10b & 10c  HIGH        LOW       HIGH                                         10a & 10c  HIGH        HIGH      LOW                                          ALL        LOW         LOW       LOW                                          ______________________________________                                    

The comparators 394 and 398 and the circuit breaking detector 400 arerespectively connected to the RS-FF's 378, 380 and 382. The indicatorsL_(f), L_(g) and L_(h) turn ON and OFF according to the combinationslisted above. At the same time, the output of the RS-FF's 378, 380 and382 are fed to the OR gate 344 via the diodes D₇, D₈ and D₉ which areconnected to form a kind of OR gate. When failure of any of the wheelspeed sensors is signalled by a HIGH-level output from any of thecomparators 394 and 398 or the circuit breaking detector 400, the outputlevel of the OR gate 344 goes HIGH to set the flip-flop 344, turn ON themonitor lamp 384 and deenergize the relay coil 304a of the relay circuit304.

FIG. 28 shows an operational block diagram illustrating fail-safeoperation to be taken place in each of the controllers 202, 204 and 206.In FIG. 28, a block 202-1 represents a section performing arithmeticoperation for performing anti-skid brake control operation and derivingEV and AV signal values based on the input parameters according to theprocedure set forth with respect to FIGS. 1 to 26. The arithmeticsection 202-1 feeds the EV and AV signals to a switching section 202-2through which HIGH or LOW level EV and AV sognals are output to thepressure control valve actuator via the output terminals P₁ and P₂. Afail-monitor section 202-3 is provided for performing self-checkingoperation, such as cold-start checking and operation check for eachcomponent of the anti-skid control system in every cycle of skid controloperation. The fail-monitor section 202-3 outputs the fault-indicativesignal whenever the failure of operation either in the controller or inthe operational component of the control system and/or the brake system.The fault-indicative signal produced by the fail-monitor section 202-3is output through the output terminal P₃ via an OR gate 202-4. The Orgate 202-4 is also connected, at its input terminals, to the outputterminals P₃ of the associated other controller (206 incase of thecontroller 202) via the input terminal P₄. Also, the OR gate 202-4 isconnected to an external fail-monitor circuit 202-5 to receive therefromthe fail signal as the excternal fail-monitor circuit detects failure ofthe anti-skid brake control operation. The output terminal of the ORgate is connected to the output terminal P₃ of the controller 202 tooutput fault-indicative signal. On the other hans, the output terminalof the OR gate 202-4 is connected to the switching section 202-2 toswitch the both of switching elements 202-6 and 202-7 to positionlabeled as (II) to switch the output levels at the output terminals P₁and P₂ at LOW level to place the system into APPLICATION mode.Similtaneously, the fault-indicative signal is fed to a fauid pumpcontrol section 202-8 which controls operation of the pump motor 90 ofthe fluid pump 88. The fault-indicative signal from the fail-monitorsection 202-3 serves as disabling signal for disabling the operation ofthe fluid pump control section 202-8 to terminates motor operation.

FIG. 29 is a flowchart of a background job executed by the controllers202, 204 and 206. This program will be continuously executed throughoutthe period during which the engine is running and power is supplied tothe system. Upon the onset of power supply, the controller isinitialized at a block 6001. In the block 6001, it is also performedinitial checking operation for checking each component of thecontroller, for example, CPU, RAM, ROM and input and out interface.After this, a self-monitoring program is executed to check eachcomponent in the controller 202, 204 or 206, at a block 6002. Suchself-monitoring operations have been disclosed in the co-pending U.S.Patent Applications and in the co-pending Europena Patent Applications.The contents of the above-identified co-pending Patent Applications arehereby incorporated by reference for he sake of disclosure. In theexecution of the self-monitoring programs, an error-indicative flagFL_(ERR) is set when the malfunction of a certain component of thecontroller is detected in response to the fault-indicative signalproduced by the fail-monitor section 202-3. Therefore, as will be fromthe foregoing disclosure in conjunction with the function of thefail-monitor section 202-3, the error-indicative flag FL_(ERR) is setnot only when the control system subjecting the self-monitoringoperation fails the operation but also when one of other control systemcauses failure in operation. Also, at the same time, the wheel speedsensor is checked in accordance with the procedure disclosed in theco-pending U.S. Patent Application Ser. No. 601,295 and the co-pendingGerman Patent Application No. P 34 17 144.4 mentioned above. Theprocedure for checking the wheel speed sensor disclosed in theabove-identified co-pending Patent Applications are again incorporatedby reference for the sake of disclosure. When some malfunction of thewheel speed sensor is detected, the error indicative flag FL_(ERR) wouldalso be set at the same time as the disabling flag FL_(DIS). Theerror-indicative flag FL_(ERR) is checked at a block 6003. If theerror-indicative flag FL_(ERR) is set when checked to the block 6003,the routine goes to a block 6004 wherein the outputs of each of theoutput terminals P₁ and P₂ and are set to zero, the output at the outputterminal P₃ is set to 1 which output serves as fault-indicative signal.The output of the output terminal P₅ is set to 1 for a predeterminedperiod of time, i.e. 2 sec. This serves to drive the working fluidaccumulated in the accumulators 70 and 56 in the braking circuit back toa master cylinder (not shown). As a result, as described above, thepressure control valve is actuated to the APPLICATION mode positionallowing manual control of the build-up and release of braking pressuresolely depending upon the depression force applied to the brake pedal.

If the error-indicative flag FL_(ERR) is not set as checked at the block6003, then anti-skid brake control according to the control programs setout with reference to FIGS. 13 to 15, 19, 20 and 23 is carried out at ablock 6005. The control signals derived according to these anti-skidcontrol programs are thus send to each of the actuator coils. Afteroutputting the control signals, the operation of each component of thesystem is checked at a block 6006. If a malfunction of any component isdetected in the block 6006, the error-indicative flag FL_(ERR) is set.After the block 6006, the error-indicative flag FL_(ERR) is againchecked at a block 6007. If the error indicative flag FL_(ERR) is set atthe block 6007, then the routine goes to the block 6004 to perform thefail-safe operation.

On the other hand, if the error-indicative flag FL_(ERR) is not set whenchecked at the block 6007, then the output level of the output terminalP₃ set to HIGH at a block. 6008. After this, the input level at theinput terminal P₄ is checked at a block 6009 which corresponds theoutput condition at the output terminal P₃ of the associated controller.If the output level of the input terminal P₄ is LOW, then fail-safeoperation is performed in the block 6004. Otherwise, the input levelfrom the external fail-checking unit as performed by the fail-monitorsection 202-3 as set forth above, is read out at a block 6010. At ablock 6011, the input level from the external fail-chacking unit ischecked if it is LOW. When the input level is LOW, then process goes tothe block 6004 to perform the fail-safe operation. On the other hand,when the input level remains HIGH as checked at the block 6011, then theprocess returns to the block 6002 to repeat control operation withchecking feature.

FIGS. 30 and 31 show another embodiment of the controller in theanti-skid brake control system according to the present invention.Although only a single controller has been illustrated in FIG. 31, twoother controllers with substantially the same circuitry as illustratedwill be employed in practice.

Similarly to the foregoing first embodiment, the oveall anti-skid brakecontrol system comprises three controllers 500-FL, 500-FR and 500-Rrespectively adapted to control brake operation of front-left wheelbrake system, front-right wheel brake system and rear wheels brakesystem. Each of the controllers 500-FL, 500-FR and 500-R comprises amicroprocessor constructed substantially the same as illustrated in FIG.12. Each of the controllers 500-FL, 500-FR and 500-R derives the EV andAV signals which are output through switches 504 and 506 in a switchingcircuit 508 of the controller 500 which represents each of thecontrollers 500-FL, 500-FR and 500-R, and the output terminals P₁ andP₂. Also, the controller 500 is connected to a pump driver signalgenerator 510 to feed a trigger signal thereto, through respectiveoutput terminal P₅. In practice, the trigger signal is produced when thesystem is to be operated in either RELEASE mode or HOLD mode. The driversignal generator 510 produces a driver signal when triggered. The driversignal is applied to the base electrode of a switching transistor Tr₁₃to turn the latter ON. As a result, electrical power from the battery512 is supplied to a relay coil 514 in a motor relay 516 to energize therelay coil. As a result, the relay switch 518 of the relay circuit 516closes to complete the power supply circuit to the motor 90 of the fluidpump.

On the other hand, the EV signal output through the P₁ output terminalof the controller 500 is applied to the base electrode of a powertransistor Tr₃₀ via an amplifier 525. When the EV signal is HIGH, thetransistor Tr₃₀ is turned ON to apply the battery voltage to an actuatorcoil 522 of an EV valve 524. Similarly, the AV signal from the P₂ outputterminal of the controller 500 is applied to the base electrode of thepower transistor Tr₃₁ via an amplifier 526. The transistor Tr-is turnedON by a HIGH-level AV signal input to supply battery voltage to anactuator 528 of an AV valve 530 and energize the latter. The combinationof the EV and AV signals defines the operation mode of the anti-skidbrake control system as described with reference to the foregoing firstembodiment.

As shown in FIG. 31, each controller 500 has an arithmetic circuit 502.The arithmetic circuit 502 is also connected for output to a first faultdetector 532. A waveform shaping circuit 534 receives and processes thesignal from the wheel speed sensor 536 into a train of pulses which isthen sent to the arithmetic circuit and the fault detector 532. Thefault detector 532 is designed to detect program errors, faulty inputsfrom the wheel speed sensor or errors in the output values of the EV andAV signals. The fault detector 532 may comprise any known circuitrysuitable for detecting malfunction of the controller. For example, theerror monitoring systems incorporated by reference in the firstembodiment may be employed singly or in combination. The fault detector532 is connected to an AND gae 538 at its output.

On the other hand, the controller has another input terminal P₄ which isconnected to the output terminal P₃ of other controller. For instance,the output terminal P₃ of the controller 500-FL is connected to theinput terminal P₄ of the controller 500-FR, the output terminal P₃ ofthe controller 500-FR is connected to the input terminal P₄ of thecontroller 500-R, and the output terminal P₃ of the controller 500-R isconnected to the input terminal 500-FL. Each of the controller 500FL,500FR and 500-R also includes another fault detector 540 which isadapted to receive input from the associated other controller throughthe input terminal P₄. The fault detector 540 is adapted to normallyfeed HIGH level signal to the AND gate 538 to normally establish the ANDcondition. The fault detector 540 is responsive to the fault indicativeinput through the input terminal P₄ from the associated controller, toturn the output level to LOW. By the LOW level output of the faultdetector 540, the and condition in the AND gate 538 is distroyed to turnthe gate output of the AND gate to LOW.

The AND gate 538 is, in turn, connected to the output terminal P₃. Theoutput terminal P₃ of each controller 500 is connected to the baseelectrode of a switching transistor Tr₃₂. The collector electrode of theswitching transistor Tr₃₂ is connected to a relay coil 542 of a powersource relay 544 which includes a relay switch element 546 establishingand blocking power supply to the actuators 524 and 530.

The transistor Tr₃₂ turns OFF when the signal level at the outputterminal P₃ drops to LOW level in response to detection of the faultyoperation by the fault detector 532. By turning OFF of the transistorTr₃₂, the relay coil 542 is deenergized to open the relay switch element546. Thus, the power supply for the actuators 524 and 530 is blocked. Asa result, the pressure control valve is placed at APPLICATION modeposition.

The fault detector 532 is also associated with the motor-operationmonitoring circuit, the power supply monitoring circuit, the comparatorcircuit, the actuator-operation monitoring circuit, the battery voltagemonitoring circuit and wheel speed sensor monitoring circuit describedin the first embodiment.

In the fail-safe operation in response to the abnormalcondition-indicative signal, a relay coil 542 of the power source relay544 controlling the position of a relay switch 546 is deenergized toopen the relay switch. This interrupts the power supply to the actuatorcoils 522 and 528 of the EV and AV valves. As described previously, whenthe actuator coils 522 and 528 are both deenergized, the system is inAPPLICATION mode allowing manual brake control.

At the same time, the LOW level output through the output terminal P₃ ofthe controller 500 is fed to a switching transistor Tr₃₃ via an inverter548 and OR gate 550. By the inverted HIGH level input from the outputterminal P₃, the transistor Tr₃₃ is turned ON to turn ON a faultindicator 552.

FIG. 32 shows a flowchart of fail-safe program to be executed by eachcontroller 500-FL, 500-FR and 500-R. Upon the onset of power supply, thecontroller is initialized at a block 7001. In the block 7001, it is alsoperformed initial checking operation for checking each component of thecontroller, for example, CPU, RAM, ROM and input and out interface.After this, a self-monitoring program is executed to check eachcomponent in the controller 500-FL, 500-FR and 500-R, at a block 7002.In the execution of the self-monitoring programs, an error-indicativeflag FL_(ERR) is set when the malfunction of a certain component of thecontroller is detected in response to the fault-indicative signalproduced by the fail-monitor section as set out with respect to theforegoing first embodiment of the invention. Therefore, as will be seenfrom the foregoing disclosure in conjunction with the function of thefail-monitor section, the error-indicative flag FL_(ERR) is set not onlywhen the control system performing the self-monitoring operation fails,but also when the operation one of the other control systems fail.

If the error-indicative flag FL_(ERR) is not set as checked at the block7003, then anti-skid brake control according to the control programs setout with reference to FIGS. 13 to 15, 19, 20 and 23 is carried out at ablock 7005. The control signals derived according to these anti-skidcontrol programs are thus sent to each of the actuator coils. Afteroutputting the control signals, the operation of each component of thesystem is checked at a block 7006. If a malfunction of any component isdetected in the block 7006, the error-indicative flag FL_(ERR) is set.After the block 7006, the error-indicative flag FL_(ERR) is againchecked at a block 7007. If the error indicative flag FL_(ERR) is set atthe block 7007, then the routine goes to the block 7004 to perform thefail-safe operation.

On the other hand, if the error-indicative flag FL_(ERR) is not set whenchecked at the block 7007, then the output level of the output terminalP₃ is set low at a block 7007. After this, the input level at the inputterminal P₄ is checked at a block 7008 which corresponds the outputcondition at the output terminal P₃ of the associated controller. If theoutput level of the input terminal P₄ is LOW, then fail-safe operationis performed in the block 7004. Otherwise, the input level from theexternal fail-checking unit as performed by the fail-monitor section asset forth above, is read out at a block 7009. At a block 7010, the inputlevel from the external fail-checking unit is checked if it is LOW. Whenthe input level is LOW, then process goes to the block 7004 to performthe fail-safe operation. On the other hand, when the input level remainsHIGH as checked at the block 7010, then the process returns to the block7002 to repeat control operation with checking feature.

As set forth above, according to the present invention, all of theobjects and advantages sought therefor are fulfilled.

What is claimed is:
 1. In an anti-skid brake control system for anautomotive vehicle including a plurality of mutually independent controlsub-systems for controlling braking operations of respectivelycorresponding braking circuits, each of said control sub-systemsincluding a pressure control valve operable among a first position inwhich braking pressure in the corresponding brake circuit is increased,a second position in which the braking pressure in said correspondingbraking circuit is decreased and a third position in which the brakingpressure in said corresponding braking circuit is held constant, anactuator connected to said pressure control valve to operate the latteraccording to a control signal, a wheel speed sensor producing a sensorsignal indicative of rotation speed of a corresponding vehicular wheel,and a controller receiving said sensor signal for deriving said controlsignal on the basis thereof,a method for performing a fail-safeoperation when failure of operation in one of the control sub-systems isdetected, comprising the steps of: monitoring operation of each of saidcontrol sub-systems for detecting a malfunctioning control sub-system,disabling said actuator of said malfunctioning control sub-system andmaintaining said corresponding control signal at a value indicative ofsaid first position of said pressure control valve thereby allowing amanual mode of operation, and producing a fault-indicative signal; andmonitoring operating conditions of other control sub-systems by checkingthe presence of said fault indicative signal, and performing a fail-safeoperation by disabling said actuator of other malfunctioning controlsub-systems and holding, to corresponding control signal at a valuecorresponding to said first position and producing otherfault-indicative signals corresponding to the other control sub-systems.2. The method as set forth in claim 1, which further comprises a step ofturning on a fault warning indicator in response to said faultindicative signal.
 3. The method as set forth in claim 2, which furthercomprises a step of recording data identifying malfunctioning componentsof said control sub-system in response to ssaid fault-indicative signal.4. The method as set forth in claim 1, wherein said anti-skid brakecontrol system includes a first control sub-system for controllingbraking operations for a first driven wheel, a second control sub-systemfor controlling braking operations for a second driven wheel, and athird control sub-system for controlling braking operations on drivingwheels; andsaid first control system connected to said second controlsub-system for detecting malfunction in said second control sub-system,said second control sub-system connected to said third controlsub-system for detecting malfunction in said third control sub-system,and said third control sub-system connected to said first controlsub-system for detecting malfunction in said first control sub-system.5. The method as set forth in claim 4, wherein said first controlsub-system is also connected to said third control sub-system fordetecting malfunction in said third control sub-system, said secondcontrol sub-system is also connected to said first control sub-systemfor detecting malfunction in said first control sub-system, and saidthird control sub-system is also connected to said second controlsub-system for detecting malfunction of said second control sub-system.6. A fail-safe system for an anti-skid brake control system whichincludes a plurality of respectively independent brake controlsub-systems comprising:a plurality of hydraulic brake circuits, eachcorresponding to one of said brake control sub-systems and eachcontrolling a pressure control valve; said pressure control valvecontrolled in each of said brake circuits for increasing hydraulic brakepressure in a wheel cylinder in a first position thereof, for decreasinghydraulic brake pressure in said wheel cylinder in a second positionthereof and for holding hydraulic brake pressure in said wheel cylinderconstant in a third position thereof; an actuator connected to each oneof corresponding pressure control valves for operating said pressurecontrol valves between said first, second and third positions accordingto a control signal, said actuator being connected to an electric powersource to receive power supply therefrom; a sensor connected to each ofsaid brake control sub-systems for detecting wheel speed and producing asensor signal indicative thereof; a detector connected to each of saidbrake control sub-systems for detecting faulty operation of thecomponents of ssaid anti-skid brake control system and producing afault-indicative signal when faulty operation of at least one of saidcomponents is detected; and a controller connected to each of said brakecontrol sub-systems, and operative for receiving said sensor signal andprocessing the sensor signal, deriving values of wheel acceleration andslippage, deriving said control signal in accordance with said wheelacceleration and slippage values, and said controller being responsiveto said fault-indicative signal from said detector connected to asub-system having a faulty component for maintaining said correspondingcontrol signal at a value at which said pressure control valve is insaid first position thereby allowing a manual mode of operation and toterminate power supply to said actuator, and said controller furtherresponsive to other fault-indicative signals from other sub-systems tohold said corresponding control signal at a value at which saidcorresponding pressure control valve is in said first position and toterminate power supply to said corresponding actuator.
 7. The fail-safesystem as set forth in claim 6, which further comprises a fault monitorlamp energized by said fault-indicative signal.
 8. The fail-safe systemas set forth in claim 6, which further comprises a memory connected tosaid detector for storing data identifying faulty components in responseto said fault-indicative signal.
 9. The fail-safe system as set forth inclaim 8, further comprising a faulty component indicator energized whenfaulty operation of a corresponding component is detected by saiddetector.
 10. The fail-safe system as set forth in claim 9, wherein saiddetector monitors the power supply to said actuator and produces saidfault-indicative signal when the power supply is interrupted.
 11. Thefail-safe system as set forth in claim 10, wherein said detectordistinguishes between termination of power supply to said actuator bysaid controller and by external conditions, and in the former case doesnot produce said fault-indicative signal.
 12. The fail-safe system asset forth in claim 6, wherein said detector includes means receivingsaid control signal and signals indicative of the response of thecomponents of the anti-skid control system to the control signalcomprising said control signal and said response-indicative signals andproducing said fault-indicative signal when said responsive-indicativesignals do not fully correspond to the response of properly functioninganti-skid control system components to the control signal.
 13. In ananti-skid brake control system for an automotive vehicle including aplurality of mutually independent control sub-systems for controllingbraking operations of respectively corresponding braking circuits, eachof said control sub-system including a pressure control valve operableamong a first position in which braking pressure in the correspondingbrake circuit is increased, and a second position in which the brakingpressure in said corresponding braking circuit is decreased, an actuatorconnected to said pressure control valve to operate the latter accordingto a control signal, a wheel speed sensor producing a sensor signalindicative of rotation speed of a corresponding vehicular wheel, and acontroller receiving said sensor signal for deriving said control signalon the basis thereof,a method for performing a fail-safe operation whenfailure of operation in one of the control sub-systems is detected,comprising the steps of: monitoring operation of each of said controlsub-systems for detecting a malfunctioning control sub-systems,disabling said actuator of said malfunctioning control sub-system andmaintaining said corresponding control signal at a value indicative ofsaid first position of said pressure control valve thereby allowing amanual mode of operation, and producing a fault-indicative signal; andmonitoring operating conditions of other control sub-systems by checkingthe presence of said fault-indicative signal, and performing a fail-safeoperation by disabling said actuator of other malfunctioning controlsub-systems and holding the corresponding control signal at a valuecorresponding to said first position thereby allowing a manual mode ofoperation and producing other fault-indicative signals corresponding tothe other control sub-systems.
 14. A fail-safe system for an anti-skidbrake control system which includes a plurality of respectivelyindependent brake control sub-systems comprising:a plurality ofhydraulic brake circuits, each corresponding to one of said brakecontrol sub-systems and each controlling a pressure control valve; saidpressure control valve controlled in each of said brake circuits forincreasing hydraulic brake pressure in a wheel cylinder in a firstposition thereof, and for decreasing hydraulic brake pressure in saidwheel cylinder in a second position thereof; an actuator connected toeach one of corresponding pressure control valves for operating saidpressure control valves between said first and second positionsaccording to a control signal, said actuator being connected to anelectric power source to receive power supply therefrom; a sensorconnected to each of said brake control sub-systems for detecting wheelspeed and producing a sensor signal indicative of the wheel speed; adetector connected to each of said brake control sub-systems fordetecting faulty operation of the components of said anti-skid brakecontrol system and producing a fault-indicative signal when faultyoperation of at least one of said components is detected; and acontroller connected to each of said brake control sub-systems, andoperative for receiving said sensor signal and processing the sensorsignal, deriving values of wheel acceleration and slippage, derivingsaid control signal in accordance with said wheel acceleration andslippage values, and said controller being responsive to saidfault-indicative signal from said detector connected to a sub-systemhaving a faulty component for maintaining said corresponding controlsignal at a value at which said pressure control valve is in said firstposition thereby allowing a manual mode of operation and to terminatepower supply to said actuator, and said controller further responsive toother fault-indicative signals from other sub-systems to hold saidcorresponding control signal at a value at which said pressure controlvalve is in said first position and to terminate power supply to saidcorresponding actuator.